A post-incident review is a structured examination of a security event, such as a breach, outage, or failed control, to determine what happened, why it happened, and what should change. It is often called a lessons-learned review, but its real purpose is not just documentation: it turns incident handling into measurable improvement.
In cyber security, this process matters because attackers often exploit the same gaps repeatedly-unclear ownership, delayed detection, weak escalation paths, or controls that do not work as expected. A strong review is usually blame-free so responders can share accurate technical and operational details. The output should be tracked corrective actions with owners, deadlines, and verification, not a polished report that sits unused. Frameworks such as ISO/IEC 27035 and NIST guidance commonly inform this work. When done well, the review helps organizations strengthen detection, response, and resilience against the next attack.