The platform team has become the team the incident response depends on, the team the CISO has been quietly relying on, the team the breach response will land on before the security team has even opened the runbook. The honest framing matters here, because the platform team the CISO has been treating as the team that builds the feature sits as the platform team the CISO will need the moment the breach lands.
What follows runs as the working version of the field guide. The shorter version is what the security team and the platform team actually have time to read.
What the platform team does during IR
Three things, in roughly that order of how much each one matters. The first runs as the system access, where the access the platform team has, the production access, the cloud admin access, the database access, the access the security team does not have, the access the platform team uses to pull the log, the snapshot, the forensic artefact the security team needs. The second runs as the system change, where the change the platform team can make, the firewall rule, the routing change, the credential rotation, the system change the security team cannot make from the SIEM console, the change the platform team makes in the minutes the response requires. The third runs as the system context, where the context the platform team has, the context the new service the developer just shipped, the configuration the platform team changed last week, the dependency the platform team knows about, the context the security team does not have.
What the security team cannot do without the platform team
Three things, in roughly that order of how much each one matters. The first runs as the containment, where the containment the security team can recommend but cannot execute, the isolation, the credential rotation, the network rule, the containment the platform team has to deploy, the containment the response will be stuck on without the platform team. The second runs as the forensic data, where the data the security team needs from the production system, the snapshot the security team cannot take, the log the security team cannot pull, the network capture the security team cannot run, the forensic data the platform team has to provide. The third runs as the restoration, where the restoration the security team can validate but not deploy, the rebuild the platform team has to run, the configuration the platform team has to restore, the restoration the response will be stuck on without the platform team.
How to align the two teams
Three moves if you are the CISO or the security team that wants the platform team to be the partner the response requires. Build the joint runbook, where the runbook the security team and the platform team write together, the runbook that names who does what in the first 60 minutes, the runbook that includes the contact tree, the access path, the decision point, the runbook the security team and the platform team should rehearse quarterly. Train the platform team on IR, where the training the security team provides, the training that explains what IR is, what the platform team will be asked to do, what the security team needs from the platform team, the training the platform team should get before the breach lands, the training the CISO should fund in the next budget cycle. Pay the on call, where the on call the platform team has been carrying without the pay, the on call the security team has been paying but the platform team has not, the on call pay the CISO should be matching across the team, the on call pay the CISO can fix in the next compensation cycle. The CISO that builds the runbook, trains the team, and pays the on call serves as the CISO who has aligned the two teams the response needs.
The bottom line
Platform team and IR in 2026 sit as the partnership the response depends on. The system access, the system change, the system context, those three are what the platform team does. The containment, the forensic data, the restoration, those three are what the security team cannot do without. The joint runbook, the trained platform team, the paid on call, those three are the alignment moves. The CISO that does the three aligns the teams. The CISO that has the runbook but not the relationship serves as the CISO who will be reading the breach disclosure the CISO could have prevented.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
