Incident Response from the Inside Out