When the victim panics: The missing layer in cyber incident response

Cyber security incident response assumes that people will act rationally in the moment. They will report quickly, preserve evidence, and follow guidance.

In reality, the moment someone becomes a victim of a cyber incident, those assumptions break.

This session explores what actually happens when individuals are placed under pressure during an incident. Drawing on real-world experience supporting victims, including children and families in high-risk scenarios such as coercion and sextortion, this talk examines the psychological responses that shape behaviour in the critical early stages of an incident.

When faced with fear, urgency, and uncertainty, people often:

• Delay reporting or avoid it altogether
• Attempt to resolve the issue themselves
• Delete evidence or engage further with an attacker
• Make rapid decisions that increase impact

These responses are not edge cases. They are predictable human behaviours under stress, and they actively undermine traditional incident response models.

This session will challenge the assumption that awareness and training alone are sufficient controls. Instead, it introduces a practical model for designing cyber response that reduces reliance on decision-making in the moment, improves early reporting, and stabilises individuals under pressure before technical response begin.

Attendees will gain:

• Insight into how people actually respond during cyber incidents
• An understanding of the psychological factors that drive poor decision-making under pressure
• Practical approaches to improve reporting, escalation, and early intervention
• Strategies to design response processes that reduce harm, not just contain incidents

This talk is relevant for security leaders, incident responders, and risk professionals looking to strengthen their human-layer response capability.