Red Flags in Client Security Operations: What Most Companies Get Wrong During Incidents

Been through enough security incidents on the vendor side to notice a pattern in how clients actually respond when things go sideways. It's not usually the technology that fails - it's the operational side.

Here's what separates clients who handle incidents competently from those who make it exponentially worse:

The Detection Blind Spot Most clients have tools but can't interpret what they're seeing. They'll call us about "suspicious activity" but can't articulate baseline behavior, can't compare it to previous weeks, can't tell the difference between normal load spikes and exfiltration patterns. They're essentially running instruments they don't understand. Then when we push back on timeline, they realize logs were only kept for 30 days. This costs 2-3 weeks of incident response right there.

Segmentation Theater Clients claim they're segmented - separate networks, separate access - but when we dig in, there's a shared admin account, a legacy system that bridges networks "temporarily," database credentials stored in a shared folder. It's the security equivalent of saying you locked the front door while the side window is wide open.

Incident Response Plan is a Document Actual scenario: Major vendor gets compromised. Their "incident response team" is legal, IT, and communications - who've never actually run a scenario together. No playbook rehearsals. When the incident happens, you're essentially discovering process during crisis mode. Meanwhile, 4 hours pass while they're trying to figure out who has VPN access to check systems.

Client Vetting Red Flags (from Our Perspective) When evaluating a client's security maturity, these are immediate concerns:

• They can't name their incident response lead or who handles forensics
• They have 2FA but only for some systems, implemented piecemeal
• Their last security assessment was 18+ months ago, or was never done
• They patch "when they get around to it" rather than on a schedule
• They assume their hosting provider "handles" security

What Actually Works Clients who move through incidents cleanly tend to have:

• Clear ownership of specific roles (not committees)
• Documented procedures that've been tested at least once
• Log retention that covers 90+ days minimum
• A preexisting relationship with forensics resources (not figuring this out mid-incident)
• Realistic understanding of their own environment - no guessing about what systems exist or how they're connected

The pattern is consistent: when incident response depends on improvisation, costs and timeline explode. When there's any prep work done beforehand, it's measurably better.

Curious if this maps to what you're seeing on the client side.