Incident response
Everything I've written on incident response, with the research pieces first. Each one ends with something you can do on Monday.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
How Do You Know a Cyber Tabletop Found a Real Response Gap?
Evaluate incident-response tabletop evidence, separate discussion from demonstrated capability, and verify that corrective actions close the gaps found.
-
The First Board Briefing After a Breach
An incident response briefing should separate facts, uncertainty and decisions. Here's how I would brief executives while an investigation is still moving.
-
What Evidence Shows a Cyber Incident Is Contained?
Assess incident containment through blocked access paths, surviving sessions, trustworthy observations and explicit reopening conditions—not completed tickets.
-
When Should a Cyber Incident Trigger Executive Crisis Management?
Set cyber crisis triggers around business consequences, decision authority and time remaining—not alert counts or waiting for forensic certainty.
-
Business email compromise
I would not begin business email compromise by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
Cloud breach response
I would not begin cloud breach response by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Crisis communications
I would not begin crisis communications by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Disable the account or revoke sessions first? The order that actually works
Block sign-in first, then revoke every session and token, then reset the password. Here's why the order matters and what each step misses.
-
Do we tell customers before we know what happened?
Tell the people with a deadline what you know and don't know, on time. Tell everyone else when you can say something true and useful. How to draw that line.
-
Eradication planning
I would not begin eradication planning by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Evidence preservation
I would not begin evidence preservation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
First-hour triage
I would not begin first-hour triage by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Incident Response: What Executives Need to Know
A breach doesn't arrive with a tidy start time, a complete list of affected systems, and an attacker who politely tells you when he's left. It arrives as unc...
-
Incident command
I would not begin incident command by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Post-incident lessons
I would not begin post-incident lessons by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Ransomware containment
I would not begin ransomware containment by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Ransomware is running. Do you pull the plug or pull the network cable?
Disconnect from the network; don't power off unless you have no other way to isolate. Powering off destroys the memory evidence that tells you what happened.
-
Should we pay the ransom, and who gets to decide?
Paying is a board-level business decision with sanctions, legal and recovery consequences. Who should hold it, what has to be checked first, and why the FBI says don't.
-
The First Board Briefing After a Breach
The first briefing after a serious intrusion is an uncomfortable exercise in telling people what you know without pretending you know the rest. Executives wa...
-
The breach is live. When do you call outside counsel?
Earlier than you think, and for a reason most people get backwards.
-
The second breach is the one that gets you fired
Most organisations survive a first breach. The board is shocked, money appears, consultants arrive, and everyone agrees it was a wake-up call. The second one...
-
Third-party breach response
I would not begin third-party breach response by buying another platform or launching a large programme. I would find the boundary, the accountable owner, an...
-
What a CEO should do in the first hour of a breach
Name the incident lead, get counsel on the line, freeze outbound statements, and ask four questions. What a CEO does in hour one, and what to leave alone.
-
What to preserve before you reset credentials after a breach
Export the sign-in logs, audit logs, mailbox rules, app consents and MFA registrations before you touch the account. Here's the list, and why each item matters.
-
When is it safe to say the incident is over?
Not when systems are back. When you know how they got in, that door is shut, every persistence mechanism is gone, and clean monitoring has run long enough to trust.
-
When to call outside incident response help, and when you don't need to
Call outside help the moment the incident could trigger a legal duty, involves ransomware, or exceeds what your team can investigate in 48 hours. The thresholds, in order.
-
Who do we have to notify after a breach, and by when?
The notification map: SEC four business days, FTC Safeguards 30 days, HIPAA 60 days, state laws, your insurer, your contracts, and CIRCIA once it's in force.
-
Who's in charge of an incident when IT and security disagree?
One named incident lead with authority over containment, and a business executive who owns the risk decisions. Why the split works and how to write it down.
-
Your Incident Response Tabletop Should Make People Uncomfortable
I've seen enough security plans to know that a document can look reassuring right up until someone has to use it. The problem isn't always that the plan is w...
Nothing matches. Try another word, or ask me directly.