I’ve been breached, what should I NOT do?

In the fast-paced world of cybersecurity, the moment you suspect a breach, the pressure to act quickly can lead to mistakes that compound the attack’s impact. This scenario is particularly fraught with challenges for organisations that have never experienced a severe breach. Knowing what not to do in the critical early stages of a breach is as important as the steps you take to mitigate the damage.

In this talk, I will explore the technical missteps organisations, both small and large, commonly make when faced with their first breach. Drawing on real-world experience from actual breach responses, not just media reports, this session will provide valuable insights into what happens when things go wrong and the long-term consequences of those mistakes. From destroying critical evidence to prematurely rebuilding compromised systems, we’ll dive into the costly errors that can cripple breach investigations and delay recovery efforts.

The focus will remain on the technical aspects of breach management, including the challenges of containing a live incident, preserving data integrity, and maintaining continuity while protecting the organisation’s critical assets.

This presentation is ideal for cybersecurity professionals, IT teams, and business leaders looking to strengthen their breach response strategies by learning from others’ mistakes. You’ll walk away with a clearer understanding of the key technical considerations that must guide your actions the moment you suspect a breach and actionable insights to help your organisation avoid the most common, and most dangerous, missteps.