Incident response under pressure: Parallels between firefighting and cyber attacks

Cyber security incident response is often treated as a technical function, driven by alerts, tools, and frameworks. In reality, it is an emergency response discipline. When a serious incident occurs, teams must make fast decisions with incomplete information, communicate clearly, and work together under pressure.

This presentation explores the parallels between cyber security and real world emergency response through the lens of frontline firefighting experience. As both a cyber security operations leader and an active emergency services volunteer, Trent has led teams through high pressure incidents in both environments. His emergency service experience includes attending fires, rescues, and fatal car accidents, often in confronting and highly stressful conditions. These situations demand not only strong technical skills, but also the ability to remain composed, make critical decisions quickly, and recover afterwards.

A key theme of the session is that effective incident response is less about tools and more about people, process, and mindset. In firefighting, one of the most important qualities is staying calm and being the steady voice in the room. When leaders remain composed, others follow. The same applies in cyber incidents. Panic spreads quickly, but so does calm, and that can directly influence outcomes.

Another core parallel is training. In emergency services, teams train constantly so that when lives are at stake, actions are instinctive. Firefighters do not rise to the occasion, they fall back on their training. In cyber security, we often expect strong performance without the same level of repetition. This session highlights the importance of regular tabletop exercises and simulations to build confidence and consistency under pressure.

The presentation will also cover practical ways to improve incident response, including clear role definition, prioritising what matters most during an incident, and maintaining strong communication across teams. It will challenge the idea that every alert is equal and instead focus on understanding impact and risk in real time.

A unique aspect of this talk is the crossover between the two disciplines. Becoming better in one often leads to improvement in the other. Leadership, communication, and the ability to manage stress are highly transferable skills. Trent will share how lessons from the fireground have strengthened cyber incident response, and how structured cyber practices have also improved his effectiveness in emergency services.

This session is designed for analysts, responders, and leaders who want to improve how they perform during high pressure incidents. It provides practical, relatable examples that can be applied immediately, along with a shift in mindset around what effective incident response really looks like.

The presentation will explore many more real world examples like these, showing how calm leadership, strong training, and clear processes can transform the way teams respond when everything feels like it is on fire.