Responding to Cloud Incidents A Step-by-Step Guide from the 2025 Unit 42 Global Incident Response Report

Cloud incidents, including ransomware, distributed denial-of-service attacks and account compromise, can halt operations and jeopardise costs, reputation and customer trust. According to Unit 42 2025 Global Incident Response Report, 29% of incident investigations in 2024 involved cloud or SaaS environments, underscoring the need to protect cloud surfaces and focus on identities, misconfigurations and service interactions rather than traditional endpoints.

The guide emphasises proactive logging and evidence collection, advising organisations to enable logging within the cloud service provider and retain data for a minimum of 90 days, while centralising logs and capturing volatile artefacts and VM images to aid rapid remediation.

It also identifies identities and lateral movement as key focus areas, noting that the majority of cloud breaches begin with compromised or over-permissioned identities and that attackers often use legitimate credentials and living-off-the-land techniques to move laterally. The step-by-step approach covers triage and scoping, evidence collection, identity forensics, uncovering persistence and movement, and rapid containment, eradication and recovery to minimise enterprise disruption.