In phase A of this model, we start to see that our users have the capability of requesting for support. During this phase, the incident response team is reactive and responds as they go. It is basic firefighting that this team does on a daily basis, hoping that systems and applications don't break during patching, troubleshooting, or reconfiguration.

We start seeing major improvements as we move into phase B, where we begin to incorporate threat intelligence.