What a CEO should do in the first hour of a breach

In the first hour, a CEO does four things: confirms who is running the response and gives them authority in front of everyone; gets counsel on the line so the investigation is set up properly from the start; stops anyone outside the response team from saying anything externally; and asks four questions, then gets out of the way. You don't need to understand the attack in hour one. You need to make sure the people who can understand it have the room to do so.

Name the incident lead, out loud

The single most damaging thing I see in the first hour is three people each believing they're in charge. The CIO is directing IT, the CISO is directing security, and a well-meaning COO is directing both. NIST's incident response guidance is built around the assumption that roles and authorities are defined before an incident, and that leadership's job during one is to support the people executing the plan (Nelson et al., 2025). If your plan names an incident lead, confirm that person in front of the whole call. If it doesn't, pick one now and say it plainly: "Until I say otherwise, decisions on this incident go through her." Ambiguity costs more than a wrong choice.

Get counsel on first, not the press office

Call your general counsel, and if you have outside breach counsel on retainer, them too, before you call anyone else. There are two reasons. The first is privilege: how the investigation is structured in the first hours affects what can be protected later. The second is that the notification clocks that matter are legal ones. Public companies have four business days from a materiality determination to file a Form 8-K under Item 1.05 (U.S. Securities and Exchange Commission, 2023). Financial institutions under the FTC's Safeguards Rule have thirty days from discovery to notify the FTC if 500 or more consumers' unencrypted information was taken (Federal Trade Commission, n.d.). Health data has its own rules. Counsel will know which clocks are yours. In hour one you just need them started.

Freeze external statements

Nobody outside the response team talks to customers, press, partners, or on social media until there's an agreed statement. That includes you. The instinct to reassure people early is strong and usually wrong, because you don't yet know what's true. The FTC's breach response guidance for business is explicit that you should figure out what happened and who's affected before you notify, while not delaying notification once you know (Federal Trade Commission, 2021). Early confident statements that later turn out to be wrong do more damage than a short silence.

Ask four questions, then step back

1. What do we know for certain, and what are we assuming? Insist the answer separates the two.
2. What's been done to contain it, and what's the risk it's still spreading?
3. What do you need from me right now? Money, authority, a decision, a phone call to a vendor's executive. Give it.
4. When's the next update? Set a cadence and hold to it. Hourly in the first day is normal.

Then leave the call. A CEO hovering on the technical bridge slows the technical bridge. Your job is the decisions only you can make, and most of those come later: whether to pay, what to disclose, who to tell. Hour one is about making sure those decisions arrive with good information attached.

What to leave alone

Don't order a shutdown of systems unless the incident lead asks for it; powering off can destroy the evidence that tells you what happened (Cybersecurity and Infrastructure Security Agency, n.d.). Don't contact the attacker. Don't promise anyone that data wasn't taken. Don't fire anyone. There'll be time for accountability, and the person who made the mistake is usually the one who can explain it fastest.

What I'd do next

If you can't name your incident lead and your breach counsel from memory, that's the gap, and it's fixable in a week. The exercise I run with executives is a sixty-minute tabletop built around exactly this hour. If you want to see how your team would handle it before it's real, request a briefing. I've written more on the board side of this in The First Board Briefing After a Breach.