Getting your response right after a cyber attack is crucial - here are the mistakes to avoid: Simon Kean

This isn’t a popular statement and it certainly isn’t something that business leaders want to hear, however with today’s threat landscape being shaped by evolving AI capabilities, sprawling attack surfaces and increasing cyber aggression from hostile states, to name a few, organisations need to know how to prepare.

Despite this, we know that many cannot confidently say that they are prepared to respond and recover effectively.

The challenge is that there is no single “correct” playbook that fits every organisation. Your response needs to reflect your specific environment, protocols, risk appetite and third parties, whilst also taking into account compliance obligations and cyber insurance policies, as these will shape your incident response plan and recovery efforts.

It is easy to understand why organisations struggle, the pressure of knowing that a cyber attack is not a matter of if, but when, places a burden not only on IT and security teams, but on boards as well. We see this problem firsthand and there are two main areas for improvement that jump out; these are organisational responsibilities and internal communications.

Aside from technical responses, these areas normally feature in the list of common mistakes we see being made in the first 24 hours after a cyber attack.

Cyber incidents affect wider business events such as operational disruption, customer impact and compliance/legal repercussions. When the response is framed as “an IT problem”, key stakeholders can be left out of early decision making, resulting in misaligned priorities.

It is vital that senior leadership is involved from the planning stage onwards so that when an incident occurs, they have a clear view of what is happening, an understanding of what decisions are required and an idea of what the likely business impact will be.

In reality though, what we often see is that many organisations focus on the technical response and restoring operations, rather than mitigating the other consequences of an attack, resulting in a disjointed recovery with key errors being made and certain areas of risk being overlooked or misinterpreted.

If decision-making responsibilities are unclear, teams either wait too long for approval or take unilateral actions that conflict with business priorities.

It is also important to take other factors like cyber insurance into account, we often see that missing requirements, such as notification or evidence handling, within the first 24 hours can delay support and jeopardise claims.

Even when responsibilities have been clearly defined, communication can still break down, particularly when legal, risk and communications concerns are not addressed at the planning stage. If these factors are first considered when an incident occurs, the organisation may create avoidable exposure such as inconsistent statements, missed notification windows or unnecessary admissions before facts are confirmed.

An example of this is issuing public updates too soon, only to retract or correct them later. This can erode trust and invite greater scrutiny, highlighting the importance of close coordination between all teams before information is made public. It might sound obvious, but it really is a common mistake.

The right response requires both technical discipline and business coordination, supported by clear leadership, effective communication and timely decision making. This is not a concern limited to large enterprises, organisations of every size must consider how they would respond when an incident occurs.

No organisation can predict exactly how an incident will unfold, but every organisation can ensure its’ people are prepared to respond with confidence. By defining responsibilities, involving the right stakeholders, ensuring ongoing communication and regularly testing plans, businesses can be prepared, so confusion is reduced when every minute counts.

The first 24 hours may not determine the entire outcome, but the decisions made during that critical period can shape the operational, financial and reputational impact that follows.

Simon Kean is Head of Customer Success at Data Connect Group.