← All posts

Cybersecurity leadership

What I would ask after an incident

Kin Levi

The first post-incident question should not be who made a mistake. It should be how the system made that mistake likely and how the team recovered.

What I have learned

A fair review preserves a timeline and separates observation from judgment. It looks at decisions, incentives, missing context and safeguards that failed together.

What I would do

I would choose a few changes with owners and measurable checks, then rehearse the scenario again. A report only creates value when it changes the next response.

Kin Levi