BLOG

By David Chernitzky, CEO, Armour Cybersecurity  ·  Serving Toronto and organizations across North America  ·  Last updated August 28, 2026

Key Takeaways

• The first priority in any breach is containment, not investigation. Stopping ongoing unauthorized access takes precedence over understanding how it happened.
• Breach notification obligations under PIPEDA, GDPR, HIPAA, and US state laws have specific timelines, some as short as 72 hours, that begin from the moment the organization becomes aware of the incident.
• Evidence preservation for forensic investigation and potential legal action requires specific technical procedures. Incorrect containment actions, such as reimaging affected systems before forensic imaging, destroy the evidence needed to understand the breach and support insurance claims.
• Cyber insurance coverage activation requires specific steps and notifications. Failing to follow the insurer’s required process at the outset can jeopardize coverage for the incident costs.
• A breach response retainer engaged before an incident means the right team is available immediately when an incident occurs, without the friction of establishing a new engagement under time pressure.

Why the First Hours Determine the Outcome

A cybersecurity breach is not a single event. It is a process that begins before detection and continues until containment is complete. In the time between the initial compromise and detection, an attacker may have moved laterally through the network, exfiltrated data, established persistence mechanisms, and encrypted backup systems. When the breach is discovered, the immediate question is not what happened. The immediate question is whether it is still happening.

The decisions made in the first hours, which systems to isolate, whether to shut down or maintain certain services, how to preserve evidence while containing the attack, who to notify and in what order, determine whether the breach is contained or extended. Organizations that do not have a practiced incident response process, or that do not have access to breach response professionals within the first hour, consistently make containment decisions that damage the forensic record, extend the attacker’s dwell time, or trigger regulatory notification errors.

The parallel pressure of a live incident is significant. IT and security staff are simultaneously managing technical containment, executive leadership is demanding status updates, legal counsel is asking about notification obligations, and if the breach has caused service disruption, customer-facing teams are fielding inquiries. Without a professional breach response team that has managed this coordination before, the organization’s internal resources are overwhelmed at precisely the moment when quality decision-making is most critical.

What Armour’s Breach Response Services Cover

Armour Cybersecurity’s Breach Response Services provide immediate expert support from the moment an incident is confirmed. The response team engages within hours, not days, to take over the technical containment process, advise on isolation decisions, and begin the evidence preservation procedures required for forensic investigation. The response is coordinated with the organization’s IT team, not substituted for it.

The breach coach service provides the senior incident management expertise that coordinates the response across technical, legal, regulatory, and communications dimensions simultaneously. A breach coach is not a technical responder. The breach coach is the experienced senior adviser who has managed major incidents before and who directs the overall response, manages the legal team interface, advises on regulatory notification decisions, and keeps leadership informed with accurate, actionable updates. Having both a technical response team and a breach coach engaged from the outset is the difference between a coordinated response and a reactive one.

Technical forensics services establish the forensic record of the incident: what systems were accessed, what data was exfiltrated, how the attacker entered, how long they were present, and what they did during that time. This investigation is required for three distinct purposes: understanding and closing the vulnerability that enabled the breach, satisfying regulatory obligations to assess the scope of personal data affected, and supporting the cyber insurance claim with documented evidence of the incident and its impact. Forensic investigation conducted by Armour produces court-admissible evidence that supports both regulatory responses and potential legal action against perpetrators.

The Regulatory Notification Problem

One of the most consequential decisions in the immediate aftermath of a breach is the notification decision. PIPEDA in Canada requires notification to the Privacy Commissioner and affected individuals when the breach creates a real risk of significant harm, and this assessment must be made promptly. GDPR requires notification to the relevant supervisory authority within 72 hours of becoming aware of a breach. Most US state breach notification laws require notification to affected individuals and state attorneys general within 30 to 90 days. HIPAA requires specific notification procedures with defined timelines for healthcare data breaches.

The notification decision requires both a legal assessment of which frameworks apply to the affected data and a technical assessment of what data was actually accessed. Both of those assessments require expertise that most organizations do not have internally. Notification that is made too early, before the scope of the breach is understood, may overstate the impact and trigger unnecessary regulatory scrutiny. Notification that is made too late creates primary legal liability on top of the breach itself.

Armour’s breach response engagement includes regulatory notification advisory as a core component. The breach coach coordinates with the organization’s legal counsel to assess notification obligations across applicable jurisdictions, advises on timing and content, and supports the drafting of regulatory and individual notifications that accurately describe the incident and demonstrate good-faith compliance.

Cyber Insurance: What Needs to Happen in the First Hours

Most cyber insurance policies require prompt notification to the insurer when a breach is suspected or confirmed. Failure to notify the insurer within the required timeframe, or making containment decisions that the insurer’s panel counsel should have been involved in, can jeopardize coverage for the incident costs. Legal fees, forensic investigation costs, regulatory fines, notification costs, and business interruption claims all depend on the insurer being engaged correctly from the outset.

Armour Cybersecurity’s cyber insurance advisory service helps organizations understand their policy terms before an incident, so that when an incident occurs, the coverage activation steps are already known and can be executed without delay. Organizations that engage Armour for cyber insurance advisory enter an incident with a clear understanding of what their policy covers, what the notification requirements are, and what documentation the claims process will require.

Why Breach Readiness Changes Everything

Across the 260+ organizations Armour Cybersecurity protects in 52+ industries, the pattern in the first hours is consistent: the outcome tracks preparation. The organizations that manage breach response most effectively are the ones that have done the preparation work before an incident occurs. Armour Cybersecurity’s breach readiness assessment evaluates the organization’s incident response plan, detection capabilities, backup and recovery infrastructure, notification procedures, and executive communication processes against the demands of a real incident. The assessment identifies the gaps that would extend response time, impair decision-making, or create compliance failures under the pressure of a live event.

Organizations that have completed a breach readiness assessment have a tested incident response plan, named contacts at Armour’s breach response team, a pre-established relationship with legal counsel, and a clear understanding of their cyber insurance activation requirements. When an incident occurs, the response begins from a position of preparation rather than improvisation. The difference in outcomes is significant and well-documented across incident response practice.

Frequently Asked Questions

Should we shut down our systems immediately when we discover a breach?

Not necessarily, and possibly not at all. Shutting down systems can destroy forensic evidence, disrupt business operations, and in some cases alert the attacker to accelerate their actions. The correct containment approach depends on the nature of the breach, what systems are involved, and what the attacker appears to be doing. These decisions should be made with a breach response professional, not independently. Contact Armour’s response team before taking major containment actions.

Do we have to tell our customers immediately?

The notification timeline is governed by applicable law and the nature of the data involved. Most regulations do not require immediate individual notification; they require notification within a defined period after the scope of the breach is assessed. Premature notification before the scope is understood creates confusion and may overstate the impact. The breach coach coordinates the notification decision based on a completed forensic assessment of what data was actually accessed.

What if we do not have a cyber insurance policy?

Breach response costs, forensic investigation fees, legal counsel, regulatory fines, and notification costs are all out-of-pocket without insurance. These costs can be significant even for a contained incident. If the organization does not currently have cyber insurance, Armour’s cyber insurance advisory service can assist with obtaining appropriate coverage. If a breach has already occurred without coverage in place, Armour’s breach response services are available on a fee-for-service basis.

The Bottom Line

The first 72 hours of a breach reward preparation and punish improvisation. Containment, evidence preservation, regulatory notification, and cyber insurance activation all have to happen correctly and in parallel, under pressure, and the early mistakes are the expensive ones: destroyed forensic evidence, missed notification deadlines, and jeopardized coverage. A professional team that has done this before makes those hours count, and preparation before an incident makes the response faster still. Armour Cybersecurity provides breach response, technical forensics, breach coaching, and cyber insurance coordination from a single team through its Breach Response Services.