Response reality: Lessons from cyber incidents

Cyber incidents continue to increase in both frequency and complexity. While most organisations now have response plans in place, real world incidents consistently demonstrate that outcomes are driven less by documentation and more by how those plans are executed under pressure. Understanding how organisations respond in real time, and why response efforts succeed or fail, is critical to improving cyber resilience.

This panel brings together practitioners across incident response and cyber insurance to explore how organisations respond in real time and what can be learned from aggregated incident experience. Drawing on the panel's breadth of incident response experience and insurance claims insights, the discussion will unpack how operational response capability, rather than plans alone, determines the speed, cost, and effectiveness of incident containment and recovery.

Panel members will share patterns observed across real incidents, focusing on the points at which response efforts most often break down. These include coordination gaps, delayed decision making, and misalignment between intended response processes and operational reality, and how those issues influence business interruption, regulatory exposure, and recovery timelines.

The panel will also unpack how incident driven insights can be applied before an incident occurs to strengthen operational resilience. By grounding the discussion in real incidents observed across Australia and internationally, the panel provides organisations with a clearer understanding of how their response capability is likely to be tested and what practical steps can be taken to improve their ability to manage incidents effectively.