The presentation focuses on the importance of the lessons learned phase, the last phase in a cyber incident lifecycle. Typically lessons learned center on understanding the "how" and "why" of incidents and end up with resolving as fixes and remain there as closed, this presentation with the help of a case study will focus on how to leverage these insights into a structure that will help against threats recurrence, identification of improvements that can be employed as strategies to fortify detection and response measures.