Peter Connolly, founder and CEO at the consultancy Toro Solutions asks: how do you prepare leaders for a security crisis?
Toro Solutions and Insignia Crisis Management recently brought together people experienced in security, crisis management, communications and resilience to discuss how to prepare leaders for a serious security crisis. Most organisations work to prevent serious security incidents and plan how to respond. But a plan can only take you so far. People must make decisions quickly, with incomplete information, while the situation is still changing.
That places different demands on leaders. They need to set direction without getting drawn into detail, make decisions before every fact is known and communicate despite gaps in their understanding. How well they do that can shape the response. The discussion covered first-hour decisions, fatigue, communications, organisational culture and whether having a crisis plan means you are ready to use it.
The first hour is rarely straightforward
In the first 60 minutes, a serious incident is messy. Information arrives from across the organisation, technical teams investigate and senior leaders are asked for decisions before the wider impact is clear. Cyber incidents show this well. A technical team may know quickly that something has happened, but establishing what was accessed, what the attacker did and what it means for the organisation can take weeks or months.
Leaders are often tempted to get closer to the detail in search of certainty. Their role is to stay above it: get enough information to decide while giving those managing the incident space to work. Good leaders get the best out of their teams rather than trying to become a one person superhero. They set direction, reassess priorities and have the courage to decide without all the information.
The questions are practical. In a cyber incident, can you trust the normal network? Can the crisis team communicate safely on its usual systems and, if not, does everybody know where to go instead? The threat actor may still be watching and adapting.
Making decisions without the full picture
In a fast moving incident, information rarely arrives cleanly. Technical findings are being tested, employees report what they have seen, suppliers give updates and information may circulateexternally. Some will be accurate, some based on assumption and some simply wrong.
One approach discussed was to keep a running picture of what the organisation knows, does not know and assumes. This makes uncertainty visible and reduces the risk of an early assumption becomingaccepted as fact.
Misinformation and disinformation add to the difficulty. Leaders face gaps in their knowledge alongsidematerial elsewhere that may be outdated, inaccurate or deliberately misleading. They still have to decide, while distinguishing facts from assumptions.
The panel distinguished between reversible decisions and those harder to undo. Taking a system offline may be straightforward to reverse; an external statement or notification based on incomplete information is harder to retract. Leaders must decide what needs to happen now, what can wait and whether more information might change their decision.
People, communication and culture
A major incident draws on security, technical, communications, legal, operations and senior leadership teams, while the rest of the business still has to run.
Important roles can be overlooked. Someone must record events and decisions, track actions and keep everyone working from the same information. Organisations also need people who can step into lynchpin roles if those handling logistics, communications or the response are unavailable.
The process must be simple enough to work under pressure. When nerves are frayed, people need a clear structure, not another problem to manage.
Then there is capacity. Who takes over from someone who has worked through the night? Who covers their normal role? Who tells a senior leader to rest when fatigue affects their judgement? And if capable people are managing the crisis, who keeps business as usual running?
Communication is harder without all the answers. Waiting for certainty leaves a vacuum for media, employees, customers and others to fill. Leaders need to say what is known, what is being established and when to expect an update.
How people work together matters too. They must be able to challenge assumptions and say when something feels wrong. A serious incident can test an organisation’s stated values, particularly when the interests of employees, customers, investors, legal advisers and reputation conflict. Leaders’decisions in those moments reveal the culture that existed before the crisis.
A plan will only tell you so much
Against a backdrop of increasing global threats, businesses may feel they cannot afford to prepare and test their crisis plans. But can they afford to manage a crisis poorly?
One analogy from the discussion was professional sport, where practice takes far more time than performance. A crisis plan and an understanding of responsibilities do not show how a team will work under pressure, with incomplete information and consequential decisions.
Good exercises expose those difficulties. Remove the person everybody relies on. Disable normal communications. Introduce conflicting information. Cut off a key supplier or system. Ask what the minimum viable business looks like without a critical dependency.
The panel also stressed understanding relevant risks, mapping the software, suppliers and other dependencies the business relies on, then building scenarios around them. Exercises reveal what a written plan cannot: how people behave, where decisions get stuck, whether leaders get useful information and whether colleagues challenge one another.
No organisation knows what its next serious incident will look like. But it can understand its risks and give those leading the response experience of working through difficult situations together. As someone put it during the discussion, having a plan does not necessarily mean you can successfully deploy it.
