SANS publishes Dynamic Incident Response framework

SANS Institute has published Dynamic Incident Response: A Framework for Security Teams, written by SANS Fellow Joshua Wright. It is the first major rebuild of the SANS incident response framework in two decades and runs to 720 pages.

The book is free in every digital format under a Creative Commons licence, with HTML chapters on a companion site plus PDF, ePub and Kindle editions. A bound copy can be ordered through Kindle print-on-demand at printing cost, with no markup to SANS or to Wright.

The framework introduces the Dynamic Approach to Incident Response, an adaptive, iterative model that aligns to NIST guidance, the Cybersecurity Framework and current Department of War guidance. It replaces the linear prepare, identify, contain, eradicate, recover and lessons learned path, and is the version taught in the SEC504 course Wright authors and leads.

Three chapters are contributed by SANS instructors: Megan Roddie-Fonseca on cloud environments, Dean Parsons on operational technology and control systems, and Ryan Chapman on ransomware and cyber extortion response. Wright announced the book from the stage at RSAC 2026 after eighteen months of writing.