thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Operations

Event vs Incident vs Breach: What's the Difference?

An event is any observable occurrence in a system or network. An incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability, or violates policy, and a breach is an incident confirmed to have exposed protected data to an unauthorized party.

Security Event

Full definition
vs

Security Incident

Full definition
vs

Data Breach

Full definition
Security EventSecurity IncidentData Breach
DefinitionAny observable occurrenceEvent that harms or threatens CIA or violates policyConfirmed unauthorized access to or disclosure of protected data
VolumeMillions per dayFar fewerRare
ExampleA user logs in, a firewall drops a packetMalware infection, successful phishingCustomer records exfiltrated
ResponseLogged, maybe correlatedIncident response process invokedIncident response plus legal and regulatory notification
Notification obligationsNoneInternal, sometimes regulatoryOften mandatory (e.g. GDPR 72 hours)
Remember it

All breaches are incidents, all incidents are events, but not the reverse.

Exam tip

Expect questions asking whether a scenario requires invoking the IR plan or triggering breach notification. Notification laws generally apply only when personal data is confirmed or reasonably believed exposed.

Tested on

More Security Operations look-alikes