Security Incident Event Management

You should start with the assumption that somebody's going to abuse your system. The one I've encountered, not a lot, but I have encountered, put in a service, customers use it in a way and at a frequency you never anticipated. It dosses you. Is this an attack or is it not? Security incident event management needs to be built in now.