IT leaders respond: Staying cyber strong through security incidents

Let’s face it. Every IT team will face a security incident eventually. For Cybersecurity Awareness Month, we focused on what it means to stay cyber strong—before, during, and after an incident.
In this session, experienced IT leaders break down what actually happens in the moments that matter—what gets missed, what slows teams down, and how to respond when every second counts.
 Here’s what you’ll learn: 

• Best practices for incident response: How experienced teams prioritize, communicate, and recover when things go wrong. 

• The gaps no one talks about: The common gaps that weaken governance and how to close them before they turn into risks. 

• Reinforcing security through control: The tools that help prevent mistakes, enforce policies, and support broader security goals. 

Key Takeaways

1. Cyber strong means resilient, not invincible

• You can’t prevent every attack—phishing and user error are inevitable.

• What matters is quick detection, fast response, and minimizing damage.

• Cyber strength = resilience: detecting issues early and restoring normal operations swiftly.

2. Look beyond the usual KPIs

• Time to detect and resolve incidents is important, but so is engagement.

• Track how your teams respond, not just how fast.

3. The first few minutes set the tone

• Activate an incident command structure immediately with one person leading.

• Use clear playbooks for each incident type.

• Document everything, delegate tasks, and avoid speculation until facts are verified.

• Calm, methodical action prevents escalation.

4. Most mistakes are communication failures

• Most post-incident criticism comes from poor communication, not technical failure.

• Have templates ready for both internal and external updates.

• Prioritize clarity, accuracy, and transparency—state what’s known, what isn’t, and what’s being done.

• Study strong examples (Cloudflare and GitLab were cited) to benchmark good crisis comms.

5. Practice reveals what documents miss

• Documentation isn’t enough—tabletop exercises reveal real gaps.

• Run realistic scenarios quarterly, involving cross-functional teams beyond IT.

• Test communications, not just detection and response.

• The more often teams practice, the less friction when real incidents occur.

6. Focus on governance, not blame

• Security policies shouldn’t slow people down.

• Embed guardrails into normal workflows (e.g., automated checks, lightweight approvals).

• Security’s job is to align with business outcomes, not block progress.

• Make the secure route the easiest route.

7. Use tools that close real gaps

• Vanta helps automate compliance monitoring, freeing up security resources and reducing manual work.

• Continuous monitoring ensures tools like EDR and MDM run correctly on all systems—closing the common gap between “deployed” and “active.”

• Automation and AI simplify vendor reviews, detect issues faster, and support informed decisions. However, humans remain in the loop for critical judgments.

8. Make security part of everyday operations

• Exclaimer embeds security into daily operations, not just products.

• Regular third- and fourth-party risk reviews ensure vendors maintain high standards.

• Security awareness is delivered where employees already work to keep participation high and friction low.

• The goal is to make security second nature.

9. The mindset that matters

• The role of security teams is to enable the business, not restrict it.

• Perfection isn’t possible so you need to focus on being adaptable and transparent.

• Success lies in understanding the organization’s risk tolerance and managing within it.