Incident response in industrial control systems is a challenging and risky task, as shutting down the plant could result in significant financial losses. When dealing with advanced adversaries or system malfunction, management may be hesitant to take the drastic measures required for incident response, such as shutting down the plant.