Beyond damage control: Values-led incident response

When a cyber incident strikes, organisations often default to a standard playbook: minimise legal exposure, limit reputational damage, and reduce financial loss. But what if your organisation's core values could guide a more efficient, authentic and ultimately more successful response? This talk explores the powerful concept of Values-Led Incident Response (VLIR), demonstrating how an organisation’s mission and values can transform crisis management from an imperative and evolve into an opportunity for demonstrating brand credibility and authentic leadership.

Through real-world case studies of cyber attacks and other crises, we'll explore the critical moments where values-based decision-making dramatically alters outcomes. Attendees will learn practical strategies for incorporating organisational values into incident response plans, communication templates, and team support structures. This session is designed for security leaders, incident responders, communications teams, and organisational leaders who want to ensure their crisis response reflects who they truly are as an organisation, not just what traditional playbooks dictate.

The presentation bridges the gap between abstract organisational values and practical incident response decisions. We'll cover specific friction points where traditional IR practices often conflict with organisational values, such as speed vs security, ransom payment decisions, transparency in communications, the extent of victim support provided, and team care during extended incidents.

For each point, we'll provide actionable guidance on integrating values checks into existing IR processes without compromising response effectiveness. We'll share questions that can be incorporated into IR playbooks and meeting structures to ensure values remain central to decision-making.

The presentation includes two detailed case studies:

The talk concludes with concrete, practical implementation steps that attendees can immediately apply to their own organisations. All recommendations are based on real-world experience and research, not theoretical ideals. The presentation avoids being preachy about ethics, instead focusing on the practical benefits of aligning incident response with organisational identity.