Proper incident response involves a lot more than just "securing the vulnerable service and resetting various credentials" and it will in this case probably inv

Proper incident response involves a lot more than just "securing the vulnerable service and resetting various credentials" and it will in this case probably involve a lot of different teams. For starters, you have to document everything. At the very minimum the legal team for the company should insist on this, if no other measures, just as a CYA move. If an attacker had broad access, it's entirely possible an all hands on deck approach is required to help identify (and document) what systems were compromised. Yes, you definitely want a team working on patching the hole ASAP. You also need a team hunting for any possible persistence. Another team probably involving standing up brand new "safe" systems and failing over client systems over to those running the patched software. While that happens yet more people may start doing audits of what was compromised on the original systems. I've seen incidents where 50-80 people were pulled in to work on an incident at a company of about 150 employees. Depending on how well-funded your SoC is they can cut that number down substantially.