A business example
A business sees repeated failed logins followed by a successful login from an unfamiliar source.
Signal
The login records suggest a possible compromised account.
Investigation
The team examines access, affected systems and available logs.
Response
It contains the issue and assesses recovery and any applicable reporting duties.
What this shows
The alert starts the investigation. It does not yet show which records were accessed or establish the incident's full impact.
What it is often confused with
A security alert is a signal to investigate; its presence alone does not establish the full incident scope.
What to look at in your business
Preserve logs and timestamps and use the relevant incident-response and reporting guidance.
Context and further reading
This entry explains the business term. The related guide below provides the next layer of context; any applicable legal test depends on the transaction and relevant period.
Kosha.Services · Updated 2 October 2026