Your security paradigm is shaping your incident response - and you don’t know it

Global cybersecurity spending reached $185 billion in 2024 - a 60% increase over six years - yet ransomware campaigns surged 76%, intrusion attempts rose 60%, and cloud-targeted attacks climbed 110%. Organisations are investing more than ever and are less safe than ever. Why?

This presentation draws on original PhD research from the University of Melbourne asking a question most organisations have never considered: does the information security paradigm you adopt - Castle-Moat or Zero Trust - shape how your organisation actually responds when a critical cyber incident strikes? Using the NIST SP800-61 incident response lifecycle as an analytical lens, this research examines whether the assumptions embedded in your security philosophy influence detection, containment, eradication, and recovery behaviours in ways that current frameworks fail to capture.

Early findings from case data and interviews with senior security leaders across multiple industries are already revealing surprises. Senior leaders do not action technical incident responses - yet they lead the entire incident response process. This disconnect between strategic leadership and technical execution raises a critical question: if the people steering the response are operating from a paradigm-level understanding of security, and the people executing the response are operating from playbooks, what happens when those two frames don’t align? This research is building the evidence base to answer that question - and the early signs suggest most organisations have never examined it.

Grounded in the presenter’s own experience surviving a ransomware attack as a technology executive - the event that launched this research - this session combines practitioner reality with academic rigour. Attendees will not receive a neat answer. They will receive a framework for asking the right question: is your incident response capability aligned with your security philosophy, or is it silently working against it? For an industry that spends $185 billion a year on security and rarely examines why its defences fail at the moment they matter most, this is a question worth 40 minutes of your time.