Applying Modular Design to Maintain IR Playbooks at Scale

Learn how to revolutionize incident response playbook management through modular design principles in this 32-minute conference presentation from the SANS DFIR Summit 2025. Discover a research-backed framework that addresses the critical challenge facing cybersecurity teams, where only 23% of security professionals report their IR playbooks are updated frequently enough to maintain effectiveness. Explore how modular design concepts can transform the way organizations manage dozens or even hundreds of incident response playbooks, potentially achieving up to 50% time savings while reducing human error risks. Gain insights from Georgetown University's Cybersecurity Risk Management program research combined with extensive incident response field experience. Master practical techniques for evaluating and redesigning IR playbooks that can be immediately applied to streamline update processes and improve operational efficiency. Understand how to leverage Security Orchestration, Automation, and Response (SOAR) technology more effectively within a modular framework approach. Walk away with actionable knowledge for managing process documentation and playbooks at enterprise scale, complete with real-world implementation strategies that deliver measurable results in incident response operations.