Recurrence
Definition
Re-establishment of attacker access or re-execution of the same attack vector after the prior incident has been eradicated. Recurrence triggers the incident response process again and may reset notification obligations under breach disclosure law.
- Definition
- Attacker access re-established post-eradication
- Effect
- Restarts incident response process
- Possible trigger
- Same attack vector reused
- Legal impact
- May reset breach notification obligations
Common questions
Why would a recurrence reset an organisation's breach notification clock?+
Many breach disclosure laws tie notification deadlines to the point of discovery of unauthorised access, so a fresh compromise event, even if related to the original incident, can be treated as a new discovery that triggers its own notification timeline.
What usually causes recurrence when a prior incident was supposedly resolved?+
Common causes include an eradication step that missed a secondary foothold, the same unpatched vulnerability being exploited again, or reused credentials that were never rotated after the initial compromise.
Related terms
- Baseline Comparison
- Comparison of a recovered system's current state, including running processes, network connections, scheduled tasks, and file hashes, against a known-good reference state...
- Extended Monitoring Window
- A defined period of heightened detection sensitivity following recovery, during which security operations maintain increased logging, alert thresholds, and analyst attention. Ends...
- Honeytoken
- A synthetic credential, document, or data record placed in a monitored location. Any attempt to use or access the honeytoken is an...
- Recovery Validation
- The verification process that confirms a restored system is clean, correctly configured, and free from residual attacker access. Distinct from eradication, which...
- Tripwire
- A deliberately placed artefact or detection rule designed to fire only if an attacker returns or residual malware reactivates. Examples include canary...