When you’re under attack, most vendors offer dashboards, delays, or dead ends. Here’s how real breach response actually works—and how to spot the difference.