Bad cyber crisis decisions: An incident responder’s greatest hits and how to avoid repeating them

This presentation examines bad decisions commonly observed during real-world cyber incident responses, drawing on front-line DFIR case experience. The focus is not on technical investigation details, but on how organisational leadership and operational decisions taken during an incident materially influence outcomes, specifically where they worsened impacts despite an otherwise strong technical capability.

The session is structured around anonymised case studies and incident war stories from multiple incident response engagements. These cases span a range of incident types, including data breaches, destructive attacks, and complex multi-stakeholder investigations. 

Each case highlights a specific decision or set of decisions that proved problematic, explores how and why those decisions were made under pressure, and analyses their downstream consequences.

Rather than assigning blame, the presentation focuses on identifying recurring patterns in incident decision-making. Topics explored include unclear decision authority, delayed escalation, premature containment actions, misaligned technical and executive priorities, communication breakdowns, and the impact of cognitive bias under crisis conditions. 

A key objective of the session is to allow attendees to learn from incidents they have not personally experienced. By sharing lessons drawn from multiple organisations and sectors, the presentation provides insights that are often inaccessible due to confidentiality, but which are critical for improving preparedness. The underlying premise is that organisations should not need to "earn" these lessons through their own incidents.

For each case study, the talk addresses:

• What decision was made and the context in which it occurred
• The factors influencing that decision (time pressure, information gaps, organisational dynamics)
• The impact of the decision on incident trajectory and outcome
• Alternative approaches that could have reduced risk or improved response

The session concludes by translating these observations into practical guidance. Attendees will gain concrete takeaways for incident response planning and preparation, including how to approach design of governance structures, response documentation, and escalation models that support better decision-making during a crisis.

This presentation is intended for technical responders, security leaders, and risk stakeholders involved in cyber incident management who are seeking to strengthen their response capability through lessons learned from real incidents.