After the incident burns: What the board didn't know, couldn't decide, and wished they'd asked

Security incidents don't just happen. They are a chain of accumulated failed controls; technical, human, and organisational. Break any link in that chain, and the breach could have been avoided.

This is the central truth drawn from seven real incidents that form the backbone of this presentation. Each Incident is more informative than any frameworks, & more confronting than any maturity assessment.

This session is not a checklist. It is a real war story told from the inside room where the hardest decisions happen the war room, the boardroom, and every difficult conversation in between.

The incidents span industries: education, retail, e-commerce, critical infrastructure. Each organisation had invested in security. Several had EDR, 24/7 SOC monitoring, and managed detection and response. One had a global security team, a CISO, and an in-house operations centre. None of it was enough. Not because the technology failed, but because the failures to act from months and years before the incident.

In one case, a customer with 200GB of data exfiltrated, unable to notify impacted users for weeks because they had never classified their own data. In another, an external board member activated an unsanctioned AI meeting tool during a session that contained sensitive wellbeing information and nobody had a policy to stop it. In a third, a global retailer's CISO the very person leading the response delayed a critical recovery decision for two hours while attackers encrypted an additional two thousand workstations. By the time the required action was approved, 70% of endpoints were compromised.

These are not hypotheticals. They happened. And in each case, the technical failure was only half the story. The other half was a governance failure: a board that didn't ask the right questions before the incident, a leadership team that had no pre-agreed position on ransomware payment, an escalation path nobody had rehearsed, and critical decisions that had never been built into the incident response plan because nobody imagined they would have to make them under pressure.

The data reinforces what the case studies show. Board involvement in security decisions reduces breach costs by nearly 200,000 on average. Incident response testing reduces costs by nearly 300,000. Yet organisations continue to underspend, under-test, and over-trust particularly in their managed service providers, who are not always forthcoming with information before or during an incident.

This session will take the audience through the real sequence of events across multiple real breaches in Australia; what happened technically, what broke down operationally, and where leadership either contained the damage or made it worse. Attendees will leave with a clear understanding of the decisions that need to be made before an incident, the questions boards should be asking now, and the structural changes: from data classification to Zero Trust to ransomware positioning that separate organisations that recover cleanly from those that don't.

Security incidents don't just happen. Neither do the security governance failures that precede or follow them. Both are preventable if you know the right question to ask.