Triage is the first-pass process used to quickly judge whether a security report, alert, or extortion claim is credible and urgent. It focuses on three questions: what is exposed, how widely the issue may spread, and whether immediate action is needed. In cyber security, triage helps teams avoid wasting time on noise while still catching real incidents early.
During a ransomware claim or suspicious event, triage usually means checking logs, endpoint alerts, asset inventories, and business impact to confirm whether there are signs of unauthorized access, encryption, data theft, or service disruption. It does not replace a full investigation; it narrows the problem so defenders can prioritize containment, escalation, and communication. Good triage helps separate a threat lead from a confirmed compromise and reduces the risk of overreacting or underreacting.