Every incident has a response plan.
When the call comes, your team needs structure — not chaos. CyberTriage gives you a proven four-phase response framework, intelligent triage that shows its working, and audit-ready evidence trails that satisfy regulators and insurers.
Built for Australian regulatory requirements — SOCI Act, APRA CPS 234, Privacy Act. Part of BCyber's GRACE ecosystem.
If you were breached at 2am tomorrow, does your response start executing — or start with a phone call?
A structured, four-phase response with audit-ready evidence trails at every step — so the answer isn't panic, it's a plan already in motion.
The short answer
We’ve just had a cyber incident — what do I do right now?
Contain first, then preserve evidence, then assess reporting duties. Isolate affected systems without switching them off, keep logs and a written timeline of every action, and assess whether personal information is involved. Australian reporting clocks can start immediately: SOCI critical-infrastructure incidents within 12 or 72 hours, APRA material incidents within 72 hours, ransomware payments within 72 hours, and Privacy Act eligible data breaches promptly after assessment.
What it depends on
- Whether you are a SOCI responsible entity: critical cyber incidents with significant impact must be reported to ASD within 12 hours; relevant impact within 72 hours.
- Whether you are APRA-regulated: CPS 234 requires notifying APRA within 72 hours of becoming aware of a material information security incident.
- Whether personal information is involved: under the Privacy Act NDB scheme you must take reasonable steps to assess a suspected eligible data breach within 30 days, and notify the OAIC and affected individuals as soon as practicable once it is confirmed.
- Whether a ransom was paid: the Cyber Security Act 2024 requires in-scope businesses to report a ransomware payment within 72 hours (from 30 May 2025).
What a professional adds
- Judging severity and scope under pressure — which systems to isolate and which to keep running for the business.
- Preserving evidence so it will stand up with insurers, regulators or in court (chain of custody).
- Deciding whether a breach is “likely to result in serious harm” — a legal judgement the NDB scheme leaves to you.
Questions to ask your current provider
- If this happened at 2am, who in your organisation has the authority to isolate a system — and do they know it?
- Is your incident response plan a document, or a sequence your team has actually rehearsed?
- Could you produce a timestamped record of every action taken, if your insurer asked for it next week?
- Do you know which of the four reporting clocks above applies to you before an incident starts?
What this answer does not cover
- This is general guidance, not a substitute for a live incident responder or legal counsel.
- Reporting timeframes summarised here are simplified — the legislation defines when each clock starts.
- If you are in an active incident, call the ACSC on 1300 CYBER1 (1300 292 371) or report at cyber.gov.au.
Australian cyber incident reporting timeframes
Curated by BCyber from the SOCI Act, APRA CPS 234, the Privacy Act NDB scheme and the Cyber Security Act 2024. Simplified summary; the legislation governs. Reviewed .
| Trigger | Report to | Timeframe | Source |
|---|---|---|---|
| Critical cyber incident, significant impact (SOCI asset) | ASD (ACSC) | Within 12 hours | SOCI Act 2018 s30BC |
| Cyber incident, relevant impact (SOCI asset) | ASD (ACSC) | Within 72 hours | SOCI Act 2018 s30BD |
| Material information security incident | APRA | Within 72 hours | APRA CPS 234 (2019) |
| Ransomware or cyber extortion payment | ASD (ACSC) | Within 72 hours of payment | Cyber Security Act 2024 (from 30 May 2025) |
| Suspected eligible data breach | Internal assessment | Within 30 days | Privacy Act 1988 s26WH |
| Confirmed eligible data breach | OAIC + affected individuals | As soon as practicable | Privacy Act 1988 s26WK–26WL |
See how a structured tabletop exercise works — no commitment.
Four phases. One framework. Complete coverage.
Every incident moves through four distinct phases — each with its own timeline, objectives, and checklist. Your team always knows what to do next.
Triage
Rapidly assess the incident to determine scope, severity, and immediate containment requirements.
- Initial severity classification
- MITRE ATT&CK mapping
- AI-powered triage analysis
- Stakeholder notification
Contingency
Stop the bleeding — contain the threat, activate backup systems, and prevent further damage.
- Threat containment
- Evidence preservation
- Backup system activation
- Regulatory notification assessment
Continuity
Maintain essential business services while eradication and recovery proceed in parallel.
- Critical service maintenance
- Eradication procedures
- Forensic analysis
- Stakeholder communications
Resumption
Safely return to full normal operations with improved defences, and embed lessons learned.
- System restoration
- Post-incident review
- Playbook refinement
- Regulatory reporting completion
Four phases. Four timelines. One platform.
Most organisations stall at triage because their tools, roles, and evidence sit in different systems. CyberTriage keeps every phase connected so nothing falls through the cracks.
| Phase | Timeline | Core Question | What Goes Wrong | How CyberTriage Helps |
|---|---|---|---|---|
| Triage | 0 – 4 hours | “What just happened, how bad is it, and who do we tell?” | Teams waste hours triaging via email and spreadsheets while the threat expands. Severity is guessed, not assessed. | Synapse AI analyses the alert in seconds — severity rating, MITRE ATT&CK mapping, stakeholder notifications, and a prioritised action list, all before the first meeting starts. |
| Contingency | 4 – 72 hours | “How do we stop the bleeding and keep evidence intact?” | Containment steps clash with evidence preservation. Regulatory notification deadlines are missed because no one tracks them centrally. | Guided containment checklists preserve forensic evidence while stopping lateral movement. Built-in regulatory timelines trigger reminders for OAIC, CPS 234, and SOCI deadlines. |
| Continuity | 1 – 30 days | “Can we keep essential services running while we clean up?” | Business continuity plans exist as PDFs nobody reads. Eradication runs in a silo while operations scramble to keep the lights on. | Live service-status dashboards link eradication tasks to business-impact assessments. Stakeholder comms templates keep leadership, regulators, and customers informed without duplicating effort. |
| Resumption | 1 – 12 weeks | “How do we safely return to normal — and prove we're stronger?” | Post-incident reviews happen too late and recommendations vanish into a shared drive. The same root causes recur next quarter. | Automated evidence packs feed directly into compliance audits. Lessons learned update playbooks, risk registers, and training plans across the GRACE framework — closing the loop permanently. |
“What just happened, how bad is it, and who do we tell?”
The Problem
Teams waste hours triaging via email and spreadsheets while the threat expands. Severity is guessed, not assessed.
CyberTriage's Answer
Synapse AI analyses the alert in seconds — severity rating, MITRE ATT&CK mapping, stakeholder notifications, and a prioritised action list, all before the first meeting starts.
“How do we stop the bleeding and keep evidence intact?”
The Problem
Containment steps clash with evidence preservation. Regulatory notification deadlines are missed because no one tracks them centrally.
CyberTriage's Answer
Guided containment checklists preserve forensic evidence while stopping lateral movement. Built-in regulatory timelines trigger reminders for OAIC, CPS 234, and SOCI deadlines.
“Can we keep essential services running while we clean up?”
The Problem
Business continuity plans exist as PDFs nobody reads. Eradication runs in a silo while operations scramble to keep the lights on.
CyberTriage's Answer
Live service-status dashboards link eradication tasks to business-impact assessments. Stakeholder comms templates keep leadership, regulators, and customers informed without duplicating effort.
“How do we safely return to normal — and prove we're stronger?”
The Problem
Post-incident reviews happen too late and recommendations vanish into a shared drive. The same root causes recur next quarter.
CyberTriage's Answer
Automated evidence packs feed directly into compliance audits. Lessons learned update playbooks, risk registers, and training plans across the GRACE framework — closing the loop permanently.
Everything you need when the call comes
From the first alert to the final post-incident review — CyberTriage covers the entire lifecycle.
AI-Powered Triage
Synapse AI analyses incidents in seconds — severity recommendation, MITRE mapping, playbook selection, and prioritised actions.
NIST IR Lifecycle
Full lifecycle management from detection through post-incident review, with milestone tracking and status automation.
Incident Analytics
MTTR metrics, severity distributions, MITRE tactic frequency, playbook effectiveness scoring, and 12-month trend analysis.
PDF Reporting
One-click post-incident reports with timeline, evidence chain, MITRE mapping, and regulatory compliance sections.
Evidence & Audit Trail
Chain-of-custody evidence management with file hash verification, retention dates, and immutable audit logs.
Multi-Portal Access
Role-based portals for admin, client, staff, and observer — each with appropriate permissions and visibility controls.
Response Phase Guide
Four-phase response framework with linked policies, processes, checklists, and playbooks — client-specific or template fallback.
Incident Flywheel
Closed incidents auto-trigger risk posture updates, content generation, GRACE project creation, and playbook scoring.
Built for Australian regulatory requirements
Every feature is designed with regulatory evidence in mind. When the regulator asks, you have the proof.
SOCI Act 2018
Critical infrastructure incident notification within 12 hours. Risk Management Program with director sign-off.
APRA CPS 234
Regulated entities must maintain incident management capability, notify APRA within 72 hours, and demonstrate control testing.
Privacy Act 2024
Notifiable Data Breach scheme — assessment within 30 days, notification to OAIC and affected individuals. Uncapped civil penalties.
ASIC REP 798
Boards must demonstrate cyber resilience capability including incident response testing and executive decision-making under pressure.
AICD Cyber Governance
Directors personally accountable for cyber risk oversight — incident response is a mandatory governance capability.
How CyberTriage works
CyberTriage is BCyber's incident response management platform, purpose-built for Australian organisations navigating the intersection of cyber threats and regulatory obligations. It implements the full NIST Incident Response lifecycle mapped into four operational phases — Triage, Contingency, Continuity, and Resumption — each with time-bound objectives, best-practice checklists, and linked governance resources.
AI-Powered Incident Analysis
When an incident is reported, BCyber's AI Synapse engine analyses the context against historical data, your organisation's threat profile, and the MITRE ATT&CK framework. Within seconds, it recommends severity classification, maps tactics and techniques, selects the most appropriate response playbook from your library, and generates prioritised immediate actions. Analysts can then engage in conversational follow-up with the AI for deeper analysis.
Audit-Ready by Design
Every interaction with CyberTriage is logged — who viewed what resources, when, and whether those resources were the organisation's own customised policies or BCyber master templates serving as a fallback. Evidence items carry chain-of-custody initialisation, file hash verification, and configurable retention dates. This creates the evidentiary trail that insurers and regulators demand.
Continuous Improvement Flywheel
Closing an incident is the beginning, not the end. CyberTriage's flywheel automatically recalculates your risk posture based on incident history, queues anonymised lessons-learned content, creates a GRACE remediation project with auto-generated tasks, and scores playbook effectiveness using MTTR and containment speed metrics. Every closed incident makes your organisation more resilient.
Part of BCyber's GRACE ecosystem
CyberTriage doesn't work in isolation. It connects to every pillar of your cybersecurity programme.
Policies & risk management feed into incident response plans
CyberTriage lives here — incident response & crisis simulation
Evidence packs & audit trails validate response effectiveness
Regulatory notifications & framework alignment automated
Lessons learned feed into training & awareness programs
Proof, not promises
One anonymised result, the trail behind it, and — just as important — what it does not do. In a market full of confident claims, the sources and the limits are the point.
median time from an alert landing to the first automated containment action, across recent live-fire and tabletop runs.
- 1Timestamped from the alert reaching the response console to the first runbook action executing.
- 2Measured across anonymised incident and tabletop exercises — not a single best case.
- 3Runbooks mapped to the ACSC Essential Eight incident-response guidance and ISO/IEC 27035.
Anonymised and illustrative of typical engagements.
- It does not stop a breach ever happening — no control does; it shortens how long one has to do damage.
- It does not replace your legal or insurer notifications — it assembles the evidence for them.
- It will not take a consequential step without a human confirming it.
- Tuning severity classification for niche operational-technology environments.
- Widening the runbook library for less common attack paths.
We publish our limits on purpose. Evidence-based, mapped to recognised authorities — never a guarantee.
Executive cyber leadership — on demand
BCyber gives Australian businesses the strategic cyber leadership of a seasoned CISO — sharpened by AI, sized to your budget — without the full-time cost. We turn governance, compliance and risk into board-ready decisions and measurable outcomes, with the evidence to back them — so you move faster, prove assurance, and stay ahead of regulators.
When an incident hits, you get senior, AI-guided leadership in the room instantly — decisive direction when minutes matter and the board is watching.
Executive expertise, on demand
The strategic guidance of a seasoned CISO — sized to your business and budget, without a full-time hire.
Board & regulator confidence
Decisions and evidence your directors and auditors trust — assurance you can stand behind.
AI that compounds your advantage
Leadership that harnesses AI to spot risk earlier and act faster, so you stay a step ahead.
One team, always on
Continuity and institutional memory across your whole cyber programme — nothing falls through the cracks.
Your incident response just got an AI upgrade
The tide is rising — and with BCyber’s Virtual Agent Team and Virtual Mentor, your boat rises faster. Purpose-built intelligence that works while you sleep.
Agents that act on your behalf
Three specialist agents embedded in CyberTriage — triaging alerts, escalating to the board, and keeping regulators satisfied. They don’t replace your team; they give your team super-powers.
Monitors your incident pipeline around the clock. Pulse triages alerts, flags anomalies, and recommends response actions calibrated to your resilience posture — so nothing falls through the cracks at 2 a.m.
Board-level incident oversight on demand. Escalation decisions, impact assessments, and policy alignment for every critical event — even when your CISO is on a plane.
Maps every incident to its regulatory obligations. Breach notifications, evidence preservation, and framework-aligned documentation happen on schedule — no spreadsheet required.
Plus 4 more specialist agents — 7 total, psychometrically calibrated to your team.
Meet the full Virtual Agent TeamA mentor who never clocks off
Virtual Mentor is your always-available IR coach — trained on NIST, ISO 27035, and Australia’s Notifiable Data Breaches scheme. Ask it anything, any time.
Crisis protocol walkthroughs — from initial detection to post-incident review
Evidence handling guidance aligned to forensic and regulatory standards
Escalation decision trees tailored to your organisation’s GRACE maturity