A postmortem is a formal review held after a security incident to document what happened, what was affected, and what should change. In cybersecurity, it is more than a summary: it is a structured way to preserve evidence, reconstruct the timeline, and identify the root cause behind the event.
Postmortems matter because they turn an incident into a control improvement. A good review separates facts from blame, so teams can spot weaknesses in detection, communication, access control, configuration, or response procedures. In real attacks, postmortems often reveal that the same gap could enable repeat compromise if it is not fixed. Defenders use the findings to update playbooks, close exposed paths, improve monitoring, and assign follow-up actions. A weak postmortem, by contrast, may leave the original failure in place and increase the chance of another breach.