The first hour after a compromise: what to capture before you clean up, who to tell, and the preparation that makes all of it survivable.
