Trending
A breach rarely ends when the attacker is locked out. It continues through every email you send, every log you overwrite, and every promise you make to customers in the first seventy-two hours. The companies that come through it with their reputation mostly intact are not the ones with the biggest security budget. They are the ones that avoid a handful of predictable mistakes.
When an incident first lands, nobody knows the scope. Which systems? How many records? Is the data actually exfiltrated or just accessed? The instinct is to stay quiet until the picture is clear.
That instinct is understandable and often wrong. Notification windows vary by jurisdiction, industry and the type of data involved, and they can be short. Legal counsel should map those obligations early—this is a decision no security team should make alone, and the rules genuinely differ from country to country and sector to sector.
But disclosure is not only a legal event. Silence, especially after customers start comparing notes online, reads as concealment. You can communicate honestly without knowing everything. A straightforward first statement should cover:
Note the wording: "may be involved," not "no sensitive data was affected." Over-reassurance is the single fastest way to convert an incident into a credibility problem, because the facts tend to keep changing.
Locking down communication too tightly creates its own damage. Your support agents start improvising answers. A regional manager posts something helpful in a LinkedIn comment. An engineer vents in a group chat.
Get ahead of it. Brief your internal audience—particularly anyone customer-facing—with approved language: what happened at a high level, what they should say, and one clear escalation path for questions they cannot answer. Employees who feel informed do not speculate publicly.
Then decide who speaks externally and stick to it. A single, trained spokesperson beats a rotating cast of executives, and it beats a CEO who improvises under pressure at a press conference. Keep the message consistent across email, your status page, social media and any regulator filings.
The fastest way to make an incident worse is a well-intentioned rebuild. Reimaging laptops, wiping servers, rebooting appliances and mass-deleting phishing emails can erase exactly the artifacts investigators need.
Preserve first. That generally means capturing memory before powering anything down, taking disk images, exporting authentication logs, VPN records and cloud audit trails, and keeping original email headers rather than screenshots. Move affected systems to isolated network segments instead of switching them off. Check your cloud providers' log retention—many rotate quickly, so export early rather than assuming last month's data still exists.
Weak scoping is the second half of this mistake. Teams find one compromised mailbox and stop looking. Attackers rarely stop at one.
Bring in an incident response firm and outside counsel early, often through your cyber insurer's panel. Counsel can direct parts of the investigation where legal privilege applies, which matters if litigation follows. Waiting until week three to make those calls is common and costly.
Resetting a hijacked administrator account feels like progress. It is not containment if you never established how the account was taken over. Persistence is cheap to plant and easy to miss: additional service accounts, OAuth grants to unfamiliar third-party apps, mail forwarding rules, scheduled tasks, extra SSH keys, rogue VPN profiles, modified login scripts.
Before declaring containment, your team should be able to answer three questions in writing:
Rotate credentials everywhere the compromised account had access, not just where it lived. Check your backups, because attackers frequently target them first, and verify that a restore actually works rather than assuming it will.
A lengthy report gets written, circulated to leadership, and filed. Six months later, most of the recommended fixes remain open with no owner.
Do the review within two weeks, while memories are fresh and people remember which decisions were hard. Keep it blameless—the goal is to learn how the system failed, not to identify who to blame, because blame shuts down the honesty you need. Turn findings into a short list of actions with named owners, deadlines, and a way to verify completion.
Then rehearse. Run a tabletop exercise built around a concrete scenario, whether ransomware, a compromised third-party vendor or a stolen laptop, and include the people who would genuinely be on the call at three in the morning: legal, communications, IT, and a decision-maker with authority. Track a few metrics that mean something over time—time to detect, time to contain, time to notify.
No company handles a breach flawlessly. What separates a rough quarter from a lasting one is candour, preserved evidence, and a follow-through that people can see. And since notification requirements depend on your jurisdiction, industry and the data involved, get qualified legal advice on your specific obligations rather than relying on general guidance.
Photo: Pexels / Pixabay
