UK Cyber Week 2025

Ken Munro is presenting: Breach preparation. When it’s all going south, what should you wish that you had done yesterday

Realising that you’ve had a data breach is the start of a stressful and confusing time. Ideally you’d reach for your carefully crafted and practised incident management plan. There are three types of these 1. They don’t exist 2. They’ve never been tested 3. The rarest of all, they are practised and updated regularly.

So, in the absence of a viable plan, where do you start? We’ll walk you through 5 steps that will minimise damage and improve your chances of getting back to BAU in a timely way. Remember, the best response isn’t necessarily the fastest, it’s the one that is the most coherent, calm, and well managed.