A company discovered its data was advertised for sale on the dark web. During the initial investigation, the company determined the data was proprietary data. Which of the following is the next step the company should take?

The correct next step is to notify the applicable parties of the breach. Once a breach involving proprietary data is confirmed, legal and regulatory obligations often require prompt notification to affected individuals, customers, or regulatory bodies. This is a critical step in incident response, focusing on transparency and compliance. Identifying the attacker's entry methods is part of the forensic investigation, which typically runs concurrently with or immediately after initial containment and notification, but notification often has a stricter timeline. Reporting the breach to local authorities may be necessary depending on the nature of the data and jurisdiction, but notification to affected parties is generally a more immediate and widespread requirement. Implementing vulnerability scanning is a proactive security measure and part of post-incident remediation, not the immediate next step after confirming a breach and identifying proprietary data loss.