Lessons from a cyber crisis

The cyber security measures organisations wish they'd prioritised sooner 13 min read

Over the past few years, we’ve interviewed hundreds of employees as part of client post-incident reviews about what worked, what didn’t, what they wish they’d known or decided sooner, and how their organisation should prioritise cyber security and resilience going forward.

Despite the variety of sectors and roles, from CEOs to frontline call centre staff, the observations and post-incident actions have been remarkably consistent. Even more surprising, the measures participants say would have made the biggest difference to their response were often already available, partially implemented or on the roadmap.

In this Insight, we share this collective wisdom, with a shortlist of things people wish they’d known, done or prioritised before an incident, and projects they’ve accelerated afterwards.

Key takeaways

• Know your business and how you’ll respond. Understand your critical systems, data and dependencies, and make sure roles, decisions and response plans are clear before an incident occurs.
• Prepare for the reality of a crisis, not the ideal scenario. Build in redundancy, line up external expertise, communicate deliberately and regularly practise with the people who will actually respond.
• Finish the fundamentals before adding more. Effective logging, monitoring and existing security controls matter more than another tool. Prioritise the gaps and unfinished projects you would most regret if an incident happened tomorrow.

11 things to consider before a cyber incident

1. Know your business, really know it

It seems obvious. It’s not. A surprising number of organisations can't rapidly identify the systems, datasets and data flows supporting critical operations and services. This can make effective triage, containment and response almost impossible.

It's also important to know how long recovery will take. Recovery time objectives aren't always grounded in tested technical recovery capabilities or realistic business dependencies. That gap can have enormous consequences for decisions, customer commitments and regulatory engagement.

Today, mapping these assets and dependencies is a non-negotiable part of cyber risk management and data governance.

2. Have a (good) plan, and get familiar with it

Recent regulator decisions and judgments have reinforced that simply having a cyber incident response plan is not enough. The value of a playbook lies in whether it helps people make difficult decisions under pressure.

Developing genuinely useful playbooks requires planning, business insight and a deep understanding of the key decisions and trade-offs to be made in an incident.

3. Know who is doing what (and who's missing)

Your incident response team is bigger than you think. In addition to cyber, legal and communications expertise, response teams need operational knowledge, frontline perspectives, clearly allocated decision-making authority and trained alternates.

And yet, the people who understand how the business really operates, what customers are experiencing, and which workarounds are feasible, are often completely left out of incident response plans and tabletops. For example, frontline staff can be an invaluable source of intelligence. They are often the first to identify operational problems, changing customer behaviour, emerging scams or unintended consequences of response decisions. But they need to know what they can say, and when and where to escalate concerns. Just as importantly, the response team needs to hear what they’re seeing and being asked.

What's more, in post-incident reviews, response teams often lament not having understood the roles of other individuals and business functions.

4. Make friends with your external experts before you need them

Cyber incidents can require multiple specialist advisers to mobilise quickly and work together, including digital forensic experts, recovery specialists, threat intelligence providers, lawyers, crisis communications firms, ransomware negotiators and insurers. In some cases, the immediate need is simply to expand existing internal capacity.

These advisers are much more effective when they understand your organisation, have already been onboarded, are familiar with your plans and playbooks, and know when and how they will be engaged.

The middle of an incident is also a terrible time to negotiate engagement terms. Some advisers will require extensive access to sensitive systems, data and privileged information, so it's important to agree contractual arrangements in advance, addressing confidentiality, security, access, liability and the handling of information generated during the engagement.

5. Plan for things to break

There’s never a convenient time to have a cyber incident.

It’ll happen when executives are uncontactable, when people are unwell, in the middle of a restructure, following a product announcement, just before earnings announcements, during a sensitive transaction, or while trying to negotiate a settlement or regulatory enforcement outcome. And it’ll almost certainly happen on a Friday afternoon or just before Christmas.

And while it’s happening, other events will intensify the pressure and uncertainty: a geopolitical event, a technology outage, a hack of your call centre, or a family emergency.

It’s impossible to plan for every chaotic scenario, but you can build in redundancy, train and inform alternates for critical response roles, and establish checkpoints to revisit decisions and assumptions as circumstances change.

6. You can't investigate what you haven't recorded 

Inadequate monitoring, logging and retention is responsible for most of the containment and investigation delays that we see.

But these gaps don’t just impede technical investigations and slow recovery. They can leave organisations unable to establish whether sensitive data was accessed, delay notification decisions, and make it harder to give customers and regulators meaningful assurances.

Having monitoring and detection tools isn't enough. Their effectiveness depends on appropriate coverage, configuration, alerting, retention and the ability to investigate suspicious activity promptly.

Decide what evidence you would need to reconstruct an incident, then check that your logging captures it across critical systems, identities, cloud services and data access. Test whether logs are protected against tampering, are retained long enough to investigate incidents that began months earlier and generate meaningful alerts that reach people equipped to act.

7. Communicate early, often and with purpose

Communication shapes employee behaviour, customer protection, operational recovery, decision-making, trust and reputation. Map your stakeholders, and prepare the messages you know you'll need, in advance.

Employees can be your most effective ambassadors, but only if they are informed. Without clear guidance on what's happening, what they can say and how to respond, confusion and speculation can spread quickly. Give them timely updates on what is known, what remains uncertain, what to do and where to direct questions. They shouldn't have to rely on media reports to understand what's happening at their own organisation.

Plan for others to exploit the incident. Cybercriminals may impersonate your organisation, circulate phishing messages, or target customers and employees with related scams. Warn them about plausible follow-on scams, explain how to verify genuine communications and make suspicious approaches easy to report. Ensure frontline teams escalate reports so emerging patterns reach the response team. Your communications should help people protect themselves, not simply explain what has happened.

Good communication also depends on making incident data useful. Involve your data analytics team early and explain the decisions the data needs to support. Agree definitions, sources, reporting intervals and how uncertainty will be presented, so decision-makers can distinguish confirmed facts from estimates and understand what has changed.

8. Read the room but don’t get distracted

Media, regulators, customers and other stakeholders will demand answers before you have them.

You won’t please everyone. They won’t know what you know and they won’t understand the trade-offs you're making. The challenge is to listen, adapt and respond without allowing external pressure to displace sound risk-based decisions.

That requires more than monitoring media coverage to manage reputation. Social listening, customer enquiries, complaints and frontline feedback can provide valuable intelligence about emerging harms, changing stakeholder behaviour, misinformation, scams, operational problems and unintended consequences of response decisions.

That intelligence needs to reach the incident response team, not remain a mention count within communications or corporate affairs. Use it to test assumptions and adjust the response where warranted, but don't chase every headline.

9. Plan for privilege 

Most people don't understand how legal professional privilege works. Why would they? But as cyber incidents bring greater legal and regulatory exposure, managing privilege is itself an important risk management measure.

Privilege cannot simply be applied retrospectively to an investigation or report. Whether it attaches depends on the circumstances, including the purpose for which communications and documents are created.

Agree with your lawyers, in advance, when to involve them; how to commission and manage investigations; who will receive advice and reports; and how to identify, handle and share privileged material. Brief the response team and external experts, distinguish legal advice from operational reporting, and set clear circulation and recordkeeping protocols. Don't assume that copying a lawyer or marking a document ‘privileged’ settles the question.

Equally, not every aspect of an incident response should be treated as privileged. Protect communications and work product that genuinely qualify, without compromising the operational response or creating unnecessary confusion.

10. Practise, practise, practise … with the people who will actually respond

Most people we speak to have not participated in a cyber simulation at their current organisation in the past two years, if ever. They wish they had. A cyber incident should not be the first time your response team members interact, nor the first time plans are tested.

The reality is that we tend to overestimate our readiness for a crisis.

If you do nothing else, run at least one meaningful cyber simulation a year. Get the right people involved, including operational teams and external advisers. And make the scenario realistic. Draw on recent incidents and emerging threats, including AI-enabled attacks that may unfold faster than your existing escalation and decision-making processes can accommodate. Force decisions with incomplete information; introduce simultaneous crises and unexpected complications; and test communications, recovery, operational dependencies and stakeholder responses. Expose the consequences of decisions, rather than just asking what participants would do.

Exercises focused exclusively on executives or technical teams can leave other critical participants uncertain about their responsibilities. Short, targeted exercises involving frontline and operational teams can be just as valuable.

And remember, general crisis management exercises, penetration testing and technical control assessments are no substitute for testing how your organisation will manage a cyber incident.

Use exercises to test the human side of the response too. Given the intensity and duration of many cyber incidents, test shift lengths, handovers, support and when to bring in relief, as part of a broader strategy for managing fatigue, workload and psychosocial risks.

11. Finish what you started

One of the most frustrating post-incident observations is how often measures that could have prevented the incident, limited its impact or accelerated recovery were already identified, planned or partially implemented.

Multi-factor authentication rollouts, logging improvements, vulnerability remediation, data minimisation and resilience investments are frequently accelerated after an incident. The uncomfortable question is why they weren't prioritised before it.

And sometimes the problem isn't a lack of investment. Organisations already have the tools they need, but incomplete deployment, poor configuration, unaddressed alerts or weak ownership mean they're not delivering the expected protection.

Before investing in another security solution, make sure the ones you already have are working, and finish the projects that have been languishing on your roadmap.

Where to from here?

Cyber incidents have a remarkable ability to focus minds, unlock investment and accelerate projects that have been on the roadmap for years.

But you don't need to experience an incident to benefit from those lessons. Most of what people wish they'd done differently comes down to ordinary things organisations knew they should do, but hadn't quite got around to.

We hope these collective lessons encourage organisations to revisit their cyber security and resilience priorities, and ask whether they're waiting for a crisis to act on things they already know they should be doing.