Building an Open Organization for Cyber Incident Response
Our Purpose : We exist to transform cyber incident response from isolated, reactive firefighting into collaborative, knowledge-driven defense. Security incidents affect us all, and our collective response must be greater than the sum of our individual efforts.
Core Principles
1. Knowledge Sharing Over Secrecy
Information about threats, techniques, and responses saves organizations. We commit to sharing indicators of compromise, attack patterns, and response playbooks openly, while respecting privacy and legal obligations.
2. Community Over Competition
Cyber adversaries collaborate across borders and organizations. Defenders must do the same. We replace competitive information hoarding with cooperative intelligence sharing.
3. Speed Through Preparation
Incident response happens in minutes and hours, not days. We build and maintain open playbooks, tools, and communication channels before incidents occur, enabling rapid coordinated response.
4. Learning From Every Incident
Every security incident contains lessons. We conduct blameless post-mortems and share findings publicly to raise the collective defense posture of the entire community.
5. Inclusion and Accessibility
Effective incident response knowledge shouldn’t be locked behind paywalls or exclusive memberships. We create resources accessible to organizations of all sizes and maturity levels.
6. Technical Excellence
We maintain high standards for incident analysis, forensics, and response procedures. Our open approach doesn’t compromise rigor—it enhances it through peer review and collaborative refinement.
What We Do
Open Playbook Library
Maintain and evolve freely available incident response playbooks for common and emerging threats, continuously updated by practitioner experience.
Collaborative Threat Intelligence
Operate platforms where organizations can share indicators of compromise, tactics, techniques, and procedures in real-time while maintaining appropriate confidentiality.
Training and Skill Development
Provide open educational resources, simulations, and tabletop exercises to build incident response capabilities across the community.
Tool and Automation Sharing
Develop and curate open-source tools for detection, analysis, containment, and recovery. Automation multiplies our effectiveness.
Response Coordination
Facilitate cross-organizational incident response when threats span multiple entities, coordinating communication and technical response activities.
Post-Incident Analysis
Publish anonymized case studies and lessons learned to help others prepare for and respond to similar incidents.
Our Commitments
To Organizations: We provide practical, actionable resources that improve your security posture regardless of budget or team size.
To Practitioners: We create a professional community where experience is valued, questions are welcomed, and knowledge flows freely.
To the Public: We work to make the internet safer by raising the collective capability of defenders worldwide.
To Transparency: We operate openly, document our processes, and welcome scrutiny and improvement suggestions.
How We Work
Open Governance
Decision-making processes are transparent and community-driven. Leadership serves the mission, not personal interests.
Vendor Neutral
We collaborate with all security vendors but are captured by none. Our recommendations prioritize effectiveness over commercial relationships.
Evidence-Based
Recommendations and playbooks are grounded in real incident data, threat research, and practitioner experience—not speculation or marketing.
Agile and Adaptive
Threats evolve constantly. Our processes, tools, and knowledge bases must evolve at least as quickly.
Come and Join US, Dare to SIRT