The intrusion detection system at a software development company suddenly generates multiple alerts regarding attacks against the company's external webserver, VPN concentrator, and DNS servers. What

Maintenance schedules reflect planned downtime windows and have no bearing on the severity or urgency of an active security incident.

Service level agreements define uptime and performance expectations but do not capture the security severity or potential damage scope of an ongoing attack.

Investigating based on potential effect aligns with established incident response triage methodology, which directs responders to assess business impact, data sensitivity, and operational criticality when prioritizing alerts. An attack against a DNS server may affect all users enterprise-wide, while a VPN attack may compromise remote access - evaluating these effects determines where resources should go first. NIST SP 800-61 explicitly recommends impact-based prioritization in incident triage.

Processing alerts in arrival order (FIFO) ignores severity entirely and can result in critical incidents being delayed while lower-priority alerts are handled first.