The incident report never says what it cost the people who worked it.
After the Call told thirty incidents from the organization's side. Before the Next Call goes back to the same kind of engagements and follows the people who showed up: the analyst paged at 2:14 a.m., the MSP tech who is the only one who knows the environment, the negotiator who spends three days being polite to a criminal, the examiner who reads the files so the notification letters are accurate, and the IR manager deciding who gets woken up tonight.
Drawing on 26 years and more than 600 incident-response engagements, Travis R Barlow tells thirty composite stories across five parts:
- The Page: the call, the first hour, and who picks up
- The Bridge: seventy-two-hour days, executives looking for someone to blame, and talking to the attacker
- The Aftermath: the engagement ends, but the responder keeps going
- The Pattern: hypervigilance, gallows humour, the drink after, going numb, and the marriage and the pager
- The Way Back: rotations that mean something, debriefs about people instead of timelines, saying no to the fourth incident, and what clients can do
Each chapter teaches one lesson and ends with two practical sections. "If you do this work" is for the responder. "If you lead or hire this work" is for the managers, MSSP and MSP owners, and clients whose decisions shape how responders come through the worst week of someone else's year.
This isn't a wellness book or a complaint. It's a practitioner telling the truth about the job. The work is worth doing, and it's worth surviving too.
For incident responders, SOC analysts, DFIR examiners and MSP technicians. For the CISOs and service-provider leaders who staff them. For the boards and executives who hire them.
Every engagement and every responder in the book is a composite. No company names.
A companion to After the Call.
