Why leadership is your strongest defence in a cyber incident

In a cyber incident, your leadership is your strongest defence.

Presented by Wotton Kearney

We unpack five practical actions directors can take today to reduce legal and reputational risk when a cyber attack hits:

Cyber threats are increasingly sophisticated and frequent, so organisations must be prepared to respond, not just with technical expertise but with clear decisive leadership.

Cyber is not just an IT problem — it’s a business crisis that impacts brand reputation, stakeholder trust and operational continuity with ever-increasing legal exposure.

In a cyber attack, meeting customer expectations and protecting the interests of the business is challenging. Customer experience needs to be front and centre. How the customer experiences an incident can directly impact the reputational harm experienced, and influence regulator scrutiny.

Regulators are sharply focused on what was in place prior — to protect customers from exposure — not simply that the incident took place.

What security posture did the company take? Could it have been better? What was in place to protect customer data? Did the company retain too much data, increasing the exposure to greater than necessary?

Wotton Kearney has been involved in hundreds of incidents, often being asked, what is the board’s role in a cyber incident? What practical steps can directors take to mitigate against reputational and legal risks?

Here are the top five actions you can take now to ensure you are prepared for any incident:

1. Ensure your incident response plan clearly assigns roles across the executive and crisis management committee.

What decisions require board approval and what is the process for getting that approval?

2. Nominate a board representative to be the board’s eyes and ears during an incident. Too many cooks in the kitchen slow the decision-making process.

3. Test the incident response plan by conducting multiple tabletop scenarios to ensure it is fit for purpose. Does it work? Does everyone from the board to the executive know their role?

4. Know what security controls are in place to protect the most sensitive data. If they are not adequate, then do something about it. Regularly evaluate whether you still need the data you hold and delete what you don’t. Are vendors and partners held to the same cybersecurity standards?

5. Have well-established vendor relationships in place including cybersecurity forensic vendors, lawyers, incident response managers and crisis communication experts. Use the experience of these experts to guide you. Don’t take on these functions internally — obtain objective and experienced help.