Breach response is trained to see one victim—personal data and the notification clock—while the theft of a trade secret, often the far larger loss, goes unrecognized until the window to protect it has closed. This article shows how to fold intellectual-property protection into incident response, following a fictional diagnostics maker whose intrusion carries off both a customer database and its crown-jewel reagent process. It explains why post-breach conduct can preserve or forfeit trade secret status under the Defend Trade Secrets Act's reasonable-measures standard, how to distinguish a trade-secret hunt from a bulk-data sweep, and how to keep the DTSA's remedies—injunction, exemplary damages, attorneys' fees, and ex parte seizure—open rather than waived. It works through forensic documentation built to a litigation rather than a regulatory standard, the privilege trap that turned Capital One's forensic report into a discovery exhibit, the collision between disclosure duties and secrecy, and the fragmented insurance that rarely covers the real loss. The throughline is simple: a trade secret case is won or lost in the years of quiet discipline before the breach, and in the first hours after it.