Incident response follows a lifecycle: preparedness, detection, containment, eradication and recovery. A breach on one node can spread laterally to connected nodes until detection and containment isolate it, after which recovery restores service.
spread: node -> neighbor with prob p_spread
detect: compromised -> flagged after t_detect
contain: flagged -> isolated (edges cut) after t_contain
recover: isolated -> healthy after t_recover
- Detection speed — how quickly the security team notices a compromised node and flags it.
- Containment speed — how quickly a flagged node is isolated from its network neighbors, stopping further spread.
- Recovery speed — how quickly an isolated node is cleaned and restored to healthy service.
Faster detection and containment shrink the "blast radius" of a breach; this model races the intrusion's spread rate against the response team's detect-contain-recover pipeline across a node graph.