What OODA is
OODA stands for Observe, Orient, Decide, Act — a decision cycle developed by military strategist John Boyd. The core idea: in any contest between two sides, whoever cycles through observation to action faster and more accurately tends to come out ahead, because they're reacting to the current situation while the other side is still reacting to an older one.
Why it maps onto security incidents
Observe is what your logs, monitoring, and alerts actually show — the raw signal. Orient is where you interpret that signal against your specific systems, history, and threat context, and it's the step most teams quietly skip. Decide means choosing a response, even an imperfect one, rather than waiting for certainty that never arrives. Act is executing that response, which immediately feeds back into a new Observe.
Where teams actually get stuck
Most incident response failures happen at Orient, not at Observe or Act. Teams often have the data — they just misread what it means because they don't have accurate context built in ahead of time: what's normal for this system, what changed recently, who owns it.
Applying it practically
Build your Orient step in advance, before an incident, not during one. Know your normal baseline well enough that anomalies are recognizable at a glance. Keep an accurate, current asset inventory so 'is this server even supposed to be doing that' has a fast answer. Run tabletop exercises so the Decide and Act steps aren't being invented live, under pressure, for the first time.