Why so serious? Making Incident Response More Effective With a Curiosity Mindset

Sarah Fuller opens by defining incident response as contextualizing, validating and acting on alerts and requests that demand critical thinking. She argues that automation and formal training take time many teams lack, so a culture of curiosity can help sooner. In her framing, curiosity means asking questions, seeking peer input, owning what you learn and aligning work with business priorities.

The middle of the talk compares the NIST incident response lifecycle with the SANS DARE model. Fuller rewrites each stage as a question an analyst should answer, such as whether an alert reflects real intent to harm. She contrasts passive habits, like waiting for alerts or accepting an automated verdict, with active ones like baselining behavior and hunting for unknowns. Her main case involved a web application firewall alert that repeatedly auto-blocked accounts. By building a 90-day baseline and contacting the identity team, she found the account owners, which led to alert tuning and a lasting cross-team relationship. A second example describes a tool inventory she built during onboarding, which an engineering team later needed and which grew through a team exercise.

In closing, she answers audience questions about building rapport with remote colleagues, handling discouraged curiosity and avoiding burnout. Her practical advice is to build relationships across teams, leave yourself notes for low-energy days and aim for consistent delivery.