Trial by Fire: Why Incident Response Depends on Structure, Not Speed

Lee Sult, Chief Investigator at Binalyze, argues that incident response failures rarely begin with a lack of tools. They begin when teams lose discipline under pressure.

One of the most valuable concepts discussed in the interview is the "Core Four" that every team should answer during an active cyber incident:

• Does the attacker still have access to the environment?
• Which systems are affected?
• How did the attacker get in?
• What data is at risk?

Sult also explains why elite organizations often rely on frameworks built on FEMA's National Incident Management System (NIMS) and Incident Command System (ICS), allowing them to operate with pre-defined command structures, communication channels, and decision-making processes before a crisis begins.

Other topics covered include:

• Why complexity creates opportunities for attackers to hide
• The growing expertise gap between attackers and defenders
• The Smoke Jumper, DFIR Product Builder, and Internal Incident Manager archetypes
• Why organizations often struggle to coordinate during major incidents despite having talented teams

Full interview:

https://www.technadu.com/trial-by-fire-why-incident-response-depends-on-structure-not-speed/629340/

Do you agree that structure under pressure is more important than tooling during a major cyber incident?