The first call is almost never from the security team. It is from a customer, a bank, a journalist, or an extortion note on a screen. This article walks through what actually happens in the first six hours of a security incident and why the decisions made there determine everything that follows. It explains why containment and evidence preservation pull in opposite directions, and how to do both. It covers the notification clocks that start before anyone knows what happened, and why the answer to when to notify is almost always not yet. It explains how privilege works in incident response and why most companies destroy it in the first hour. It covers ransomware decisions honestly, including the payment question. It closes with the small number of preparations that change outcomes.