When the “everything is down” call hits at 3 A.M., most teams are improvising, not calmly following a polished playbook. This session walks through a practical incident response game plan built for real world, resource constrained teams facing ransomware, BEC, and disruptive malware. Attendees will learn what to do in the first hour, the first day, and the first week of an incident, how to use tools they already own more effectively, and how to communicate clearly with leadership and vendors under pressure. You will leave with a simple 3 A.M. checklist, containment decision tips, and patterns you can plug directly into your existing IR processes.