The Boardroom Under Fire

Last month I watched a team of fourteen work through a ransomware attack in CMD. Eleven minutes in, their Data Protection Officer said, quite calmly, that there were breach reporting obligations to think about. Everyone was busy with something else, so it didn’t really land, and the DPO didn’t get pulled into the main conversation until the hour mark, forty-nine minutes later. By then a story about the attack had been doing the rounds on social media for forty minutes, and the first decision on comms came at minute sixty-six.

I’d bet their incident response plan covers every one of those decisions. Most plans do. What the plan can’t tell you is what happens to fourteen people trying to follow it at once, with a phone ringing.

We only know about the forty-nine minutes because of two things CMD does that a tabletop run on a slide deck doesn’t.

The first one is the phone. During the exercise, CMD rings people’s actual mobiles. On the other end is an AI voice agent playing whoever the scenario needs… the IT lead with bad news, a journalist who’s got hold of the story, the regulator wanting to know what you knew and when. They hold a real conversation. They react to what you say, they push back, and they don’t go away because you’d rather deal with it later.

And that’s a VERY different thing from someone reading “a journalist calls the CEO” off a slide and the room having a nice chat about what they’d probably say. When it’s a voice in your ear asking for a comment before they publish, people say things they would NEVER put in writing. Some of it is brilliant. Some of it… less so. Either way you found out in a meeting room and not on the front page.

The second is the After Action Report. Every decision in a CMD session is timestamped. Every call is transcribed. Every vote records who chose what. So when it’s over you’re not relying on the facilitator’s notes and everybody’s slightly generous memory of how it went. You get the timeline… who spotted what, when they spotted it, and how long it took to reach the person who could actually do something about it.

Nobody in that room noticed the forty-nine minutes while it was happening. They were busy. Which is why you need something that was watching the clock for them.

And the report names people. The good calls and the slow ones. Because “communication could be improved” gives a team nothing to work on, and “the DPO raised it at eleven minutes and was brought in at sixty” gives them something they can fix next week.

We’ve just put thirteen scenarios live on the platform… ransomware that starts with one phishing email, a supplier getting compromised, somebody threatening to leak your data, a work phone lost on public transport, a security researcher getting in touch to say they’ve found a hole in your systems. You can see the full list here.

So get your incident response plan out and find the first phone call in it. Who makes it, who picks up, and what are they supposed to say? Then ask whether that person has ever said it out loud, to a stranger, with a clock running. If they haven’t, start there.