From Security Theatre to Real Resilience: Why Most Incident Response Plans Fall Apart
Razorwire Cyber Security & InfoSec InsightsShow Notes
Are you ready for the cybersecurity incident that could bring your business to a standstill? On this episode of Razorwire, I sit down with Marius Poskus, a CISO and vCISO, to tackle one of the most crucial yet overlooked aspects of information security: incident response. Whether you’re leading a cyber team, supporting your board, or simply keen to sharpen your readiness, we dig into what happens when your best defences fail and chaos strikes.
We talk about what actually happens when an incident hits and why polished policies on their own aren't enough. From the practical realities CISOs face at the sharp end of an incident, through the pitfalls of security theatre, to the importance of clear communications and building resilience, we get into the lessons the playbooks often miss. Marius and I talk through wargaming, learning from unexpected scenarios and how to empower teams to make tough decisions on the fly.
Key talking points: Wargaming the Unthinkable: What happens when your CEO dies? When your entire C-suite is on a plane for six hours and unreachable? When someone poisons the fish at a team dinner? Jim and Marius talk about why the most valuable wargaming exercises aren't the predictable ones. Testing unusual, uncomfortable scenarios is what exposes the single points of failure nobody thought about and builds the kind of muscle memory that no written policy can replace. Decision-making Authority in Crisis: One of Marius's contacts had a major ransomware incident and needed to hire 200 people within hours. The biggest problem wasn't the attack itself, it was getting budget approved and contracts signed fast enough. Learn why pre-agreed access to emergency funds, signing authority and the ability to bypass normal procurement processes can be the difference between a swift response and days of lost time. Security Theatre and Why It Falls Apart Under Pressure: Marius has been making waves on LinkedIn talking about companies that want the appearance of security rather than the real thing. In this episode, he and Jim get into why polished policies that have never been tested crumble the moment a real incident hits, how to tell the difference between genuine preparedness and box-ticking and what it actually takes to build an incident response capability that works when it matters. Listen and step inside the mindset every cybersecurity professional needs before the worst happens. On testing your plan: "You never want to run through an incident response scenario first time when the real thing happens." Marius Poskus
Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen
In this episode, we covered the following topics: The Importance of Incident Response Find out why incident response is still one of the most neglected areas of security, how to get organisational buy-in for proper preparation and what happens when the first time you test your plan is during the real thing. Security Theatre vs. Real Preparedness Learn how focusing on the appearance of security rather than genuine preparedness leaves organisations vulnerable when a real incident hits, and what it takes to build real readiness through testing and practice. Practical Testing and Muscle Memory Discover why written policies aren't enough on their own and how regular testing and tabletop exercises help teams build the confidence to act effectively under pressure. Authority and Decision-Making During Events Learn how to set up clear escalation paths and decision-making authority before an incident happens, including access to emergency funds and the ability to hire specialist support at short notice. C-Suite Engagement and Support Find out how senior executives can best support their security teams during an incident, from trusting CISOs to lead the response to providing practical help like food, hotel rooms and team rotations. Communication and PR During Incidents Explore how thoughtful, transparent communication can pro
More from Razorwire Cyber Security & InfoSec Insights
Awards you have to pay to win, events you have to pay to attend and conferences that expect speakers to work for free. When did recognition and expertise in cybersecurity become something you have to buy? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by security consultant and regular community speaker James Bore and Gary Hibberd, co-founder of Consultants Like Us and the Real Cyber Awards and Conference. Pay to play takes many forms in cybersecurity, from awards that come with entry fees and expensive tickets to events charging vendors thousands for access to decision makers. At the same time, large commercial conferences can expect experienced speakers to give up days of preparation, travel at their own expense and appear on stage in return for little more than exposure. Jim, James and Gary look at where legitimate commercial arrangements end and questionable practices begin. They discuss what gives an award credibility, when paying for access to an event can be worthwhile and why the way cybersecurity treats its speakers could ultimately affect the quality of the events themselves. Three key talking points When recognition comes with a price tag Not every paid award works the same way. From outright offers to buy recognition to free entries followed by expensive ceremony tickets, we look at the different forms pay to play can take and why credibility depends on what happens behind the award. Should cybersecurity speakers be paid? Community events and large commercial conferences operate very differently. We discuss when speaking for free makes sense and why expectations should change when an event is making significant money from exhibitors and attendees. Good speaking takes work A short conference talk can take days of preparation. James and Gary get into the work behind becoming a strong speaker, why experience and preparation matter and what happens when events prioritise sponsored slots over good content. If you're deciding which awards and events deserve your time, or building a reputation as a cybersecurity speaker, this conversation is for you.
If most of your applications no longer run on the endpoint, why are you still managing and securing it as though they do? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this Spotlight on Technology episode I'm joined by James Millington, Healthcare Field CTO for EMEA at IGEL, with more than 25 years' experience across virtual desktops, endpoint security and healthcare technology. The way we use endpoints has changed repeatedly. Computing moved from centralised mainframes to PCs, back towards virtual desktops and then into SaaS and cloud services. Hybrid working accelerated that shift again, while rising hardware costs, Windows upgrades and increasingly distributed workforces are forcing organisations to reconsider what they actually need sitting on a user's device. Jim and James look at why the endpoint may be due another rethink. They discuss the security and cost implications of maintaining traditional operating systems, how immutable endpoints change the approach to endpoint protection and what happens as AI creates another generation of applications and risks for security teams to control. Three key talking points: Do we still need Windows at the endpoint? As applications move into SaaS, VDI and the cloud, the role of the endpoint is changing. We look at whether organisations still need a full traditional operating system on every device and what alternatives become possible when workloads run somewhere else. Moving from detection to prevention Endpoint security has traditionally relied heavily on detecting problems and responding to them. Discover how reducing what can run or change on an endpoint alters that model and removes attack surfaces before they need to be monitored. The endpoint problem AI could make worse Shadow AI gives employees another way to introduce software and move information beyond organisational controls. We discuss how controlling what can execute locally could become increasingly important as AI workloads start moving from centralised services onto endpoints.
Are cybersecurity events still giving people a reason to turn up, or have too many become expensive sales floors with the same conversations on repeat? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by James Bore, Chartered Security Professional, Gary Hibberd, co-founder of Consultants Like Us and Lisa Ventura, founder of the AI and Cybersecurity Association and Unity Group Solutions. Cybersecurity events have changed. What were once places to discover new technology, catch up with people across the industry and exchange ideas have become a packed calendar of conferences, roundtables, dinners and vendor events competing for people's time. With InfoSec Europe introducing a £50 ticket charge, it raises a bigger question about whether the traditional conference model is still delivering enough value. We look at why experienced security professionals are increasingly choosing community and fringe events, why the same conference conversations keep coming back and what actually makes an event worth attending. From vendor pitches and expensive exhibition stands to better speakers, smaller audiences and conversations in the pub next door, we discuss where cybersecurity events have gone wrong and what could make them useful again. Three key talking points: When a conference stops being worth it A ticket might be free or cost £50, but the bigger investment is your time. We look at why established cybersecurity events are struggling to give experienced professionals a compelling reason to walk through the doors. Why smaller events feel different Community and fringe events come up repeatedly throughout the conversation. Discover why smaller audiences, more focused subjects and speakers who genuinely know their field can create something the biggest conferences struggle to replicate. People don't go to events to be sold to Expensive stands and polished sales pitches do not necessarily build relationships. We discuss why attendees increasingly value access to practitioners, useful conversations and genuine connections over another lap of an exhibition hall.
What does it actually look like to break into InfoSec from the outside, with no technical background, no industry contacts and no idea what half the acronyms mean? Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this interview episode, I'm joined by Irina Sordiya, a GRC and compliance professional based in Montreal who came into information security from a finance background. Not everyone who works in information security started out in IT. Irina's route in began at a career fair where she stumbled into a fintech startup looking for someone who could translate financial regulation into language a dev team could understand. From there she moved into auditing at KPMG and eventually crossed to the other side, leading security posture and compliance in-house. This is a conversation for anyone considering a career in InfoSec or in the early stages of one. Irina talks openly about feeling like an outsider, not understanding the acronyms and slowly realising that GRC isn't about technical knowledge, it's about understanding risk, building trust and communicating with people. She and Jim also get into the growing problem of grifters in GRC, where Canadian regulation is heading and why the InfoSec community is one of the most welcoming places to build a career. Three key talking points: You don't need a technical background Irina came from a finance degree with no IT experience and a job interview where she was asked if she knew what an auditor does. She got the job. This episode is proof that soft skills, empathy and a risk mindset can take you further than most people expect. G is for grifter in GRC As regulatory pressure has increased, so has the number of people selling shortcuts. Overpriced courses, AI-generated templates, agents claiming to replace the CISO. Irina and Jim discuss why this preys on people trying to break in and why there's no substitute for doing the work. The risk mindset as a North Star The best advice Irina received early on was to develop a risk mindset. It's what helps you step back from hundred-page policies and ask what you're actually trying to protect, and why it matters more than technical knowledge for anyone in GRC.
Social engineering has been around since humans started talking to each other. The psychology hasn't changed, but AI has made the execution almost unrecognisable. Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined by Richard Cassidy, Field CISO at Rubrik, and Bec McKeown, a chartered psychologist specialising in human performance under pressure. Social engineering isn't a technology problem, it's a human one that cybersecurity has inherited. The psychology behind it hasn't changed since Cleopatra was using it to outmanoeuvre empires, but AI has transformed the speed, scale and sophistication of every stage, from automated reconnaissance that builds a complete profile in 30 minutes to real-time voice cloning that references your actual projects and travel schedule. Bec and Richard bring two very different perspectives to the same problem. Bec explains how attackers engineer the conditions in which people make decisions rather than just crafting a convincing message, and why "people are the weakest link" misses the point. Richard shares what he's seeing as a practising CISO, from family members being targeted through gaming platforms to why measuring phishing click rates gives organisations a dangerous false sense of security. Three key talking points: They're not hacking people, they're shaping decisions: Social engineering works because attackers engineer the conditions under which decisions get made, not because people are careless. Bec explains why most security awareness training is solving the wrong problem by focusing on the message rather than the environment in which people are operating. AI has turned social engineering into an automated pipeline: What used to take weeks of manual reconnaissance now takes 30 minutes. AI-powered OSINT can build a complete profile of a target and generate a tailored attack that references their projects, travel and communication style. Combined with real-time voice cloning, these layered attacks are becoming almost impossible to distinguish from a legitimate request. Your family is now part of the attack surface: If the executive is too well protected, attackers go to the people around them. Children on gaming platforms are being cultivated to unknowingly share information about their parents' work and routines, and a compromised family device on a shared home network becomes a route into the corporate environment.