I agree. I think this particular framing gets things slightly wrong. You want parallelism, but you still need central organization (so that you can have clear d

I agree. I think this particular framing gets things slightly wrong. You want parallelism, but you still need central organization (so that you can have clear delegation) and delegation of work to various researchers. For a complex incident, I've seen 5+ subteams researching various threads of the incident. But, importantly, before any of those subteams take any action, they report to the IC so that two groups don't accidentally take actions that might be good in isolation but are harmful when combined.