SANS Launches Dynamic Incident Response Framework for Evolving Cyber Threats

• •SANS Institute published a new incident response framework called DAIR.
• •The framework addresses the limitations of traditional linear incident response models.
• •The book is available for free in various digital formats under a Creative Commons license.

On September 18, 2026, SANS Institute published 'Dynamic Incident Response: A Framework for Security Teams' by Joshua Wright. This 720-page book introduces the Dynamic Approach to Incident Response (DAIR), a model designed to address the complexities of modern cyber incidents. Traditional frameworks have been criticized for their linearity, which fails to accommodate the evolving nature of attacks. DAIR emphasizes verification, triage, and iterative scoping, allowing teams to adapt as new evidence emerges. The book is available for free in multiple digital formats under a Creative Commons license. It includes contributions from experts on cloud, operational technology, and ransomware response. The framework aligns with NIST guidance and is intended to enhance the effectiveness of incident response teams. The publication follows a significant period of development and was announced at RSAC 2026 in March.