Don’t overcategorise incidents

A discussion on the difference between "network incidents" and "security incidents" led to a realization that categorizing incidents may not be effective for complex situations like major incidents, such as ransomware.

Ransomware impacts multiple aspects of infrastructure and requires a significant, challenging response from multiple stakeholders.

Causal analysis is complex and requires attention to various aspects such as system architecture, email security, user training, etc.

Complex systems fail in complex ways, and categorization can become meaningless or adversely impact an organization's flexibility and capability to respond.