The next thing an incident response team should do after establishing that an application has been breached is to isolate the impacted systems from the rest of the network, which means disconnecting them from the internet or other network connections to prevent further spread of the attack or data exfiltration. Isolating the impacted systems can help to contain the breach and limit its impact on the organization. The other options, such as maintaining the affected systems in a forensically acceptable state, conducting a risk assessment, or informing senior management, may be done later in the incident response process, after isolating the impacted systems. References:
* https://www.crowdstrike.com/cybersecurity-101/incident-response/
* https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks
* https://www.invicti.com/blog/web-security/incident-response-steps-web-application-security/