What is SIRT?
A Security Incident Response Team (SIRT) is the operational force responsible for protecting business assets from security threats. Its mission is to identify risks, respond to attacks, investigate compromise, and help the organization maintain business continuity. SIRT brings together experienced security professionals, subject matter experts, and operational processes to turn security information into action.
SIRT serves as the execution arm of the AMI3A framework. It continuously asks the three security questions: Am I Vulnerable? Am I Under Attack? Am I Compromised? By answering these questions and acting on the results, SIRT helps reduce risk before it becomes business damage.
At its core, SIRT is an incident response organization. It focuses on protecting the value generated by software, systems, services, and data. Whether dealing with vulnerabilities, active attacks, or compromise, the team works to prevent disruption, minimize impact, and restore confidence in the environment.
Modern SIRT operations are typically divided into specialized teams that address different stages of the security lifecycle. Together they create a continuous cycle of prevention, detection, response, and improvement.
PSIRT – Product Security Incident Response Team
PSIRT focuses on vulnerabilities and security weaknesses before they become incidents. The team evaluates exposures in both first-party and third-party software, determines business risk, and drives remediation efforts. Its mission is to identify potential problems before attackers can exploit them.
CSIRT – Computer Security Incident Response Team
CSIRT focuses on active attacks and security events. The team investigates suspicious activity, analyzes attacker behavior, coordinates mitigation efforts, and supports recovery activities. Its mission is to detect and stop threats before they cause significant business impact.
TA-SIRT – Technical Advisory SIRT
TA-SIRT provides strategic guidance, research, and specialized expertise. The team supports PSIRT and CSIRT with threat intelligence, architecture reviews, incident consultation, technology evaluation, and advanced analysis. Its mission is to improve decision-making and strengthen the overall security posture.
Together, PSIRT, CSIRT, and TA-SIRT form the operational engine behind AMI3A. They combine expertise, process, and execution to answer the most important security questions and protect business value.