When a live incident does occur, Heal will use insights from Darktrace Detect to create a picture of the attack and a bespoke, AI-generated response playbook built from Darktrace's knowledge of the incident, the business's environment, and lessons learned from the security team's previous simulations. Heal recommends the priority order for remediation actions based on factors like further damage the compromised asset can cause, how much the attack relies on that asset as a pivot or entry point, and its importance to the business. Consequently, security teams can adapt their defences as an incident evolves, enabling them to end it more rapidly and with less overall disruption.