Incident response doesn’t always start with a dramatic alert or a perfectly framed timeline. More often, it starts with uncertainty.