Category security incident investigation process