Involves identifying the underlying causes of a security breach or vulnerability to help prevent future incidents.