SANS Institute Overhauls Incident Response Framework After 20 Years
Event summary
- SANS Institute published 'Dynamic Incident Response: A Framework for Security Teams' by Joshua Wright, the first major update to its incident response framework in two decades.
- The new framework, DAIR, replaces the linear model with an adaptive, iterative approach to handle evolving incidents.
- The book is available for free in multiple digital formats under a Creative Commons license.
- Joshua Wright will lead a hands-on workshop on the DAIR model at the SANS AI Cybersecurity Summit in Arlington, Virginia, on November 2 and 3, 2026.
The big picture
The update reflects the growing complexity of cyber incidents, which often involve shifting priorities and evolving attacker behaviors. DAIR aligns with current NIST guidance and Department of War protocols, positioning it as a relevant tool for modern security teams. The free distribution strategy aims to accelerate adoption, potentially setting a new benchmark for incident response frameworks.
What we're watching
- Adoption Pace
- How quickly security teams will integrate DAIR into their existing incident response processes.
- Industry Impact
- Whether DAIR will become the new standard for incident response frameworks in the cybersecurity industry.
- Educational Integration
- The extent to which DAIR will be incorporated into cybersecurity training programs and certifications.