Incident Response
There are two very different things people mean by "incident response," and I do both: building the plan before anything happens, and being the person on the call when something actually is happening. The second one is where the first one gets tested for real, and most organizations find out during an actual incident that their plan had gaps nobody noticed when it was just a document.
Before an incident
Planning work means building a response plan that's specific enough to be useful — defined roles so people aren't figuring out who's in charge during the first chaotic hour, communication plans that cover legal, executives, customers, and regulators where required, and playbooks for the incident types you're actually likely to face: ransomware, business email compromise, a compromised cloud account, a vendor breach that exposes your data. I run tabletop exercises against these plans because reading a plan and executing it under pressure are different skills, and a tabletop is where you find the gap between the two while the stakes are low.
During an incident
When something's actually happening, the priorities are containment, figuring out what actually occurred, and getting back to normal operations without making things worse along the way. I help triage what's known versus assumed, make the containment decisions that stop the bleeding without destroying evidence you'll need later, and coordinate with whoever else needs to be in the room — legal counsel, forensics specialists, law enforcement if it comes to that, insurance, and the people who need to communicate with customers or regulators. I'm direct about what I don't know yet during an incident, because false certainty in the first few hours causes more damage than admitting you're still figuring it out.
After an incident
Once things are stable, the lessons-learned review matters as much as the response itself — what actually happened, what the plan got right, what it missed, and what changes before the next one. Skipping this step is how organizations end up relearning the same lesson twice.
Who this is for
Organizations that don't have a tested incident response plan, teams that want their existing plan pressure-tested with a realistic tabletop, and anyone dealing with an active incident right now who needs an experienced hand on the call.
If something's happening right now, reach out immediately. If you want to be ready before it does, that conversation starts the same way.