Effective incident response plans elusive for most cybersecurity teams

Results from recent surveys by cybersecurity industry leaders such as Sygnia and CrowdStrike found that the vast majority of organizations don’t have effective incident response (IR) plans.

The Sygnia report found that 73% said that their organizations would not be “fully ready” if they sustained a serious cybersecurity incident.

CrowdStrike's survey reinforced that most organizations fall short: “Some organizations are prepared,” wrote the CrowdStrike researchers.  “They’ve run tabletop exercises. They know who owns each step of the response. They’ve worked with legal and external counsel to plan for worst-case scenarios. But most aren’t ready. And by the time they realize it, the adversary is already three steps ahead.”

Security pros interviewed by SC Media were equally concerned.

“In our experience responding to hundreds of ransomware and destructive cyberattacks, the biggest failure is rarely the security technology itself, it's the organization's ability to execute under extreme pressure,” said Heath Renfrow, co-founder and CISO at Fenix24.

Renfrow said while many companies have an incident response plan, very few have validated whether that plan actually works when Active Directory gets compromised, backups are questioned, identities are stolen, executives are demanding answers, regulators are calling, and the business loses millions of dollars per day.

“An incident response plan that hasn't been exercised against realistic scenarios is little more than documentation,” said Renfrow. “Organizations also tend to focus almost exclusively on prevention. The assumption is that if enough security tools are deployed, an incident can be avoided. The reality is that determined attackers continue to succeed."

Bradley Smith, senior vice president and Deputy Chief Information Security Officer at BeyondTrust, added that the 73% gap in the Sygnia survey is not a planning failure: it’s a sequencing failure. Smith said 99% of organizations have a plan, but most of those plans assume a sequence the threat environment no longer allows because with AI, full attacks can happen in under one day.

“AI in security operations is a baseline requirement now,” said Smth. “The 63% planning to embed AI in IR are right to plan for it, but AI on top of broken operational processes just runs the failures at machine speed. The fix is to use AI to build the autonomous, automated responses that match the speed adversaries have been operating at for the last six to eight months, while fixing the operational posture beneath it.”

The biggest change to the IR plan is sequence, said Smith. We need to contain before we investigate. Time-to-containment requirements in this environment are measured in minutes, and teams that investigate first will lose, said Smith.

“That requires pre-approved scopes of containment action, pre-scoped so we can measure the operational impact in advance and trust autonomous agents to act on containment authority without waiting for a human to approve each step,” said Smith. “In a world of AI-empowered adversaries, the threats are existential and the cost of an IR failure exceeds what any single company can carry. The only way to make those costs manageable is to reduce probability through attack surface reduction, and reduce blast radius through segmentation and zero-trust enforcement with no exceptions.”

Not just a deliverable: Test IR plans under pressure

Denis Calderone, chief technology officer at Suzu Labs, said while companies almost all have an IR plan in some fashion, they haven’t tested it in any meaningful way – and the people who need to execute them don’t believe they’ll hold up under pressure.

We tell our clients all the time that the only way to know if an incident response framework actually works is to put it under pressure before an attacker does, said Calderone. That means getting into a war room setting and gaming out specific threat scenarios end to end. And it does not mean a checkbox tabletop where everyone reads from a script, but a real simulation where the security team, the legal team, communications, and executive leadership are all in the room making decisions with incomplete information and time pressure, said Calderone.

Calderone said teams need to ask: Who has the authority to isolate the network? Who makes the call on whether to disclose? Who decides if operations shut down? If those answers aren't already decided and rehearsed, Calderone said we could be trying to figure them out during the worst day of our professional lives.

“According to the Sygnia survey, 89% of respondents cite limited executive or board involvement in IR readiness,” said Calderone. “That's the root cause. Incident response keeps getting treated as a security team deliverable, but the hardest decisions in a breach are executive decisions. The CISO can identify the threat and recommend a course of action, but the CEO has to authorize the business disruption that comes with containment. If that conversation is happening for the first time during an active incident, the attacker has a head start that you're not getting back.”

Harry Thomas, co-founder and CTO at Frenos, pointed out that while most companies have an IR plan, far fewer have an IR plan grounded in how their environment can actually be attacked.

Thomas said in industrial organizations, one of the biggest gaps is the inability to prove how an attacker could move from corporate IT into ICS and OT, or enter through vendor access, remote services, shared identities, and other trusted connections. Thomas said if responders do not know the real paths into operational systems, the playbook was largely built on assumptions. During an incident, the team has then been forced to discover the attack path, determine the potential operational impact, and decide what can be safely isolated while production is already at risk.

“Incident response should be derived from fact-driven evidence: what can reach what, which paths lead to operational crown jewels, which controls are supposed to stop each step, and whether those controls have actually been validated,” said Thomas.

Here are five practical mitigation recommendations from Thomas:

“A generic tabletop can prove that people know how to communicate,” said Thomas. “An evidence-driven exercise proves that the organization can actually see, contain, and recover from the attack paths that exist.”