RT @taosecurity: Too many "best practice" docs imply that "incident response" is a one-off event, not a continuous biz practice. New term needed?