From Security Theatre to Real Resilience: Why Most Incident Response Plans Fall Apart

Are you ready for the cybersecurity incident that could bring your business to a standstill?On this episode of Razorwire, I sit down with Marius Poskus, a CISO and vCISO, to tackle one of the most crucial yet overlooked aspects of information security: incident response. Whether you’re leading a cyber team, supporting your board, or simply keen to sharpen your readiness, we dig into what happens when your best defences fail and chaos strikes.We talk about what actually happens when an incident hits and why polished policies on their own aren't enough. From the practical realities CISOs face at the sharp end of an incident, through the pitfalls of security theatre, to the importance of clear communications and building resilience, we get into the lessons the playbooks often miss. Marius and I talk through wargaming, learning from unexpected scenarios and how to empower teams to make tough decisions on the fly.Key talking points:Wargaming the Unthinkable:What happens when your CEO dies? When your entire C-suite is on a plane for six hours and unreachable? When someone poisons the fish at a team dinner? Jim and Marius talk about why the most valuable wargaming exercises aren't the predictable ones. Testing unusual, uncomfortable scenarios is what exposes the single points of failure nobody thought about and builds the kind of muscle memory that no written policy can replace.Decision-making Authority in Crisis:One of Marius's contacts had a major ransomware incident and needed to hire 200 people within hours. The biggest problem wasn't the attack itself, it was getting budget approved and contracts signed fast enough. Learn why pre-agreed access to emergency funds, signing authority and the ability to bypass normal procurement processes can be the difference between a swift response and days of lost time.Security Theatre and Why It Falls Apart Under Pressure:Marius has been making waves on LinkedIn talking about companies that want the appearance of security rather than the real thing. In this episode, he and Jim get into why polished policies that have never been tested crumble the moment a real incident hits, how to tell the difference between genuine preparedness and box-ticking and what it actually takes to build an incident response capability that works when it matters.Listen and step inside the mindset every cybersecurity professional needs before the worst happens.On testing your plan:"You never want to run through an incident response scenario first time when the real thing happens."Marius PoskusListen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listenIn this episode, we covered the following topics:The Importance of Incident Response Find out why incident response is still one of the most neglected areas of security, how to get organisational buy-in for proper preparation and what happens when the first time you test your plan is during the real thing.Security Theatre vs. Real Preparedness Learn how focusing on the appearance of security rather than genuine preparedness leaves organisations vulnerable when a real incident hits, and what it takes to build real readiness through testing and practice.Practical Testing and Muscle Memory Discover why written policies aren't enough on their own and how regular testing and tabletop exercises help teams build the confidence to act effectively under pressure.Authority and Decision-Making During Events Learn how to set up clear escalation paths and decision-making authority before an incident happens, including access to emergency funds and the ability to hire specialist support at short notice.C-Suite Engagement and Support Find out how senior executives can best support their security teams during an incident, from trusting CISOs to lead the response to providing practical help like food, hotel rooms and team rotations.Communication and PR During Incidents Explore how thoughtful, transparent communication can protect reputation and rebuild trust after a breach, and why generic "we take security seriously" messaging does more harm than good.Resilience and Recovery Strategies Learn how to maintain business operations while an incident is unfolding, from planned team rotations and post-breach customer support to quantifying downtime for the board.Wargaming and Scenario Thinking Find out why testing unusual scenarios, not just technical failures, helps organisations expose single points of failure and prepare for real-world unpredictability.Critical Thinking and Cybersecurity Career Skills Discover why curiosity, initiative and adaptability matter more than following prescribed instructions, both for handling incidents and for building a career in cybersecurity.Learning from Mistakes and History Explore how drawing on real historical events and shared industry experiences equips professionals to handle crisis situations, make tough decisions and build personal resilience.Resources Mentioned SolarWindsCited as a high-impact security incident affecting third parties and requiring significant communication. https://www.solarwinds.com/Professor MesserCited as a free educational resource for CompTIA courses.https://www.professormesser.com/Network ChuckMentioned as a well-known YouTuber focused on networking tutorials and resources.https://www.youtube.com/c/NetworkChuckCompTIAReference to a popular provider of IT and cybersecurity certifications.https://www.comptia.org/Y2K (Year 2000 problem)Discussed as a past example of widespread incident response planning.https://en.wikipedia.org/wiki/Year_2000_problemChangi JailHistorical site referenced during a discussion of resilience and decision-making under pressure.https://en.wikipedia.org/wiki/Changi_PrisonRorke’s DriftBrought up as a historical account to learn about resilience.https://en.wikipedia.org/wiki/Battle_of_Rorke%27s_DriftApollo 13 (“Houston, we have a problem”)Referenced as an example of problem solving under extreme pressure with limited resources.https://en.wikipedia.org/wiki/Apollo_13US Military zombie apocalypse wargamingReferenced as an example of creative scenario planning for incident response.https://en.wikipedia.org/wiki/CONOP_8888The Y-FilesReferenced as a source of conspiracy theories and unusual scenarios Jim enjoys.https://www.youtube.com/@TheYFilesConnect with your host James ReesHello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and...