Transition to Escalation

The loop ends here, or it doesn’t

The Scope → Uncover → Risk loop introduced on the Risk overview is the engine that drove the investigation to this point. For an unresolved case, crossing into Escalation happens when the loop terminates, when the residual risk is well-enough understood to justify a resolution decision. If the evidence is ambiguous and the loop is still sharpening the picture, refine the scope and run it again rather than escalating a case you cannot yet defend.

The loop is never a reason to sit on a confirmed criterion, though. A loop that is confirming new lateral movement Lateral Movement Adversary traversal from the initial-access host to other hosts inside the environment. Each hop expands the blast radius and adds new entities for Subject analysis. Often piggybacks on legitimate authentication, which is what makes it hard to detect. or data staging Data Staging Sensitive data collected and stored locally in chunks before exfiltration, avoiding large, sudden transfers that DLP would flag. has already answered the escalation question: the break-glass rule fires, IR takes ownership, and the loop keeps running in parallel as scoping support under IR’s clock. The distinction is confirmation versus suspicion. Suspicion iterates; confirmation escalates from wherever the investigation happens to be standing.

---

What the Escalation chapter picks up

The ground this handoff feeds into is covered where it belongs, in the Escalation chapter. The four canonical criteria define when escalation is warranted: confirmed malicious activity, high-impact or business-critical systems, lateral movement or exfiltration, and an ongoing or widespread campaign. The handoff packet defines what makes an escalation actionable rather than merely justified.

Risk’s contribution to both is the verdict itself: impact, likelihood, and the named evidence that produced them, stated precisely enough that the packet can be assembled without re-deriving the investigation.

---