Skip to content
Exploit Labs
IR-200 · OSIR · For security teams

IR-200: what the course covers - and what we add.

IR-200 (OSIR) covers the incident response lifecycle: preparation, detection, containment, evidence preservation, recovery and lessons learned.

Who it is for

Incident response owners and teams that need a defensible process.

Course content (official scope)

  • IR process and roles
  • Containment and evidence preservation
  • Host and network analysis
  • Communication and post-incident work

Course content, labs and the OSIR exam are provided by OffSec. The official course description always takes precedence. This page reviewed: 2026-08-07.

What Exploit Labs adds
  • +A tabletop exercise built on a realistic attack path from our engagements

For security teams

Multiple people, role paths, reporting and procurement run through OffSec Learn Enterprise.

See Learn Enterprise

For individual practitioners

Individual licence, access duration, exam attempts and preparation - start here.

See individual licences