A course covering how organizations detect, investigate, and recover from security incidents. Students apply the incident-response lifecycle, preserve and analyze digital evidence across disk, memory, and network sources, perform malware triage, and produce reports suitable for technical, legal, and executive audiences.