Security Intelligence

Case Study: Fixing the First Hour of Incident Response

The information existed; it just reached the wrong people in the wrong order. A one-page first-hour card and a single reporting line closed the gap.

By Mowlid Ali 08 Sep 2026 6 min Security Intelligence
Source

Originally reported by INGO ADVISORY. INGO ADVISORY analysis is attributable to our intelligence desk; the underlying reporting remains the property of the publisher.

Read the original publication View all 5 citations
Author
Mowlid Ali
Source
INGO ADVISORY
Publication date
08 Sep 2026
Location
Client locations withheld
Country
Ethiopia
Category
Security Intelligence
Threat level
SUBSTANTIAL — An attack is likely.
Analytic confidence
High
Verification status
Verified
Listen · 2 minReady to play · about 2 min

Anonymised practitioner case study. The organisation, precise locations and dates are withheld to protect the client and its staff. Internal metrics are not published, and none has been invented in their place.

The client

An organisation with field offices across several Ethiopian regions on different security trajectories, reporting into one national office.

The problem

After a serious field incident, the review found that the essential facts were known within twenty minutes but the country director learned of them ninety minutes later, through a third party. Staff had not withheld information; they had each told the person they trusted, and no single line carried the report upward.

Most incident-management failures are not decision failures. They are routing failures.

The method: the first-hour card

  • One page, laminated, in every vehicle and office: who to call first, second and third, with numbers, and what to say.
  • A fixed initial report format, what happened, where, who is affected, what is needed now, what is not yet known.
  • An explicit instruction to report before the picture is complete, with 'unknown' as an acceptable answer.
  • One reporting line, always the same, regardless of who is on duty or who the reporter knows best.
  • A single logbook opened at first notification, with times recorded as events occur rather than reconstructed afterwards.
  • A no-blame reporting rule, stated in writing and repeated by senior management in person.

What changed

Notification stopped depending on relationships. Because 'unknown' was permitted, early reports arrived early, and leadership could begin acting while facts were still being confirmed. The logbook also gave the organisation a defensible account for donors and insurers.

Transferable lessons

  • Separate notification from assessment. Speed matters for the first, accuracy for the second.
  • Permit incomplete reports explicitly, or you will receive late complete ones.
  • One reporting line. Alternatives become the default under stress.
  • Start the log at minute one; nobody reconstructs timings honestly afterwards.
Africa Risk Brief

Get the weekly Africa Risk Brief

Analysis like this — on security intelligence and Africa's highest-risk operating environments — delivered every Monday. Free.

No spam. Unsubscribe anytime. We never share your email.