SECURETHEORY
Advisors
I've led incident response across dozens of board-reported incidents. The technical response matters — but these are the lessons that actually preserve trust when something goes wrong.
Enterprise customers can absorb a security incident. They do not want to be surprised, misled, or managed with generic PR language. Transparency, frequency, and accuracy are the things that preserve trust when something goes wrong.
The responsibilities of leaders should be established clearly, and alignment between management and the board built before an incident — not during it.
The best board meeting I ever ran was one where I said no more than 20 words. I introduced two leading experts on malware incidents, and a 30-minute session ran for 90 minutes. The issue: the board did not agree with management's theory of handling ransomware.
Psychological safety is the most important marker of a high-performing team, and it shows up in spades during a security incident.
The proudest moment of my CISO life was when my lead responder kicked the CTO out of an incident room because he was confusing people by tasking them. Did I pay a penance for that? Absolutely — but it was so worth it. And we managed the incident beautifully.