Incident Playbook

Evaluates whether the protocol has a defined, rehearsed process for detecting and responding to a compromise. The existence and maturity of pre-agreed response procedures is the primary input.

Tier	Reasoning	Evidence
No compromise plan	Protocols that discover their incident response process at the moment they need it consistently produce worse outcomes; the response window is consumed by ad-hoc coordination while losses accumulate.	Stream Finance (November 2025) and Resolv (March 2026) announced asset losses days after on-chain anomalies were first visible to third-party monitors.
Mechanisms exist with ad-hoc response	Some response capability is in place, but absent defined triggers, escalation paths, and rehearsal, coordination is improvised under pressure and the containment window is partially consumed by figuring out who does what.	KyberSwap (November 2023, $48M) is illustrative: the team had a pause function and used it, but response was uncoordinated and recovery (~60% via treasury grant) was partial — the modal outcome for protocols without a rehearsed playbook.
Documented, tested incident runbook	A documented and rehearsed playbook — defined detection triggers, pre-agreed escalation paths, signer rotation procedures, and rehearsed simulations — enables coordinated response within the narrow window during which incidents can be contained.	The December 2023 Ledger Connect Kit attack produced a coordinated three-hour response across Sushi, Lido, MetaMask, and Coinbase, only possible because procedures existed and personnel knew their roles.