Episode 8

full
Published on:

2nd Nov 2026

The Most Dangerous Sentence an Executive Can Say

The most dangerous sentence in business isn't "we got hacked." It's "we've never had anything like that happen to us." Here's why, and how to test your incident response plan before you need it.

Most executives assume they have an incident response plan. What they usually have is a document nobody has rehearsed and a set of quiet assumptions about who does what. In this episode I break down what an incident response plan actually is (a business capability, not an IT document), why a tabletop exercise is the only way to find the gaps before a real breach does, and a five-phase framework for running one. I walk through it with a real-world scenario: a $400,000 wire fraud that starts with one tired employee and a convincing email.

  • Why "we've never had that happen" usually means "we haven't detected it"
  • Why the most common insider threat is your best employee on a bad day
  • The five phases of a tabletop exercise: scenario, the right room, injects, communication plan, and debrief
  • Notification windows and cyber insurance requirements to know before an incident
  • The first fifteen minutes and the first four hours of a real response

If you're a business executive looking for an independent strategy advisor, apply for a 30-minute call at https://titanof.tech.

Watch the video version: https://youtu.be/mmOCDG3IO4o

---

Independent fractional CIO for owners of $5M to $50M businesses. Technology and cybersecurity strategy, with no tools to sell, no commissions, and no conflict.

Work with me: https://titanof.tech

LinkedIn: https://www.linkedin.com/in/johnbarker78/

Transcript
Speaker:

John Barker (2025): Your accounts payable manager just wired

Speaker:

$400,000 out of the company.

Speaker:

It's 9:15 on a Tuesday morning.

Speaker:

She has no idea anything is wrong.

Speaker:

She didn't make a mistake.

Speaker:

She followed the company process exactly.

Speaker:

She got an email from your CFO marked urgent asking her to send the wire.

Speaker:

The name was right, the title was right, the domain looked right,

Speaker:

but your CFO never sent that email.

:

00 when someone finally notices, the money is gone, and the clock on

:

a dozen decisions your company has never made before just started running.

:

Who gets called first?

:

Who has the authority to freeze the accounts?

:

When or if do you tell your clients?

:

When do you call your lawyer?

:

Do you even know if your cyber insurance still covers you

:

once you start making moves?

:

Here's the part nobody wants to hear.

:

The reason most companies lose far more than that first $400,000 isn't

:

the attack, it's the next four hours, and almost none of them have

:

ever rehearsed those four hours.

:

Almost none of them believe they will ever need to.

:

If you ever heard someone in your company say some version of, "Well,

:

we've never had that happen before"

:

here's what that sentence actually means.

:

It doesn't mean your organization hasn't been targeted.

:

It doesn't mean you haven't been breached.

:

It means you haven't detected anything, and those are not the same thing.

:

The average time between an attacker entering an environment

:

and an organization discover them is measured in months.

:

The executive who says, "We've never had that happen," may be completely sincere.

:

They may also have an active intrusion right now that nobody has found yet.

:

That sentence is not a security posture, it is a gap in your

:

awareness dressed up as confidence.

:

Today, we're gonna talk about what an incident response plan actually

:

looks like, why most organizations don't have one, and how to build the

:

muscle before you need it because the one guarantee I can give you

:

is that you will eventually need it

:

So let me ask a direct question.

:

If a cyber incident hit your organization right now, not

:

tomorrow, right this second, who is the first person that gets called?

:

Who makes the decision to shut systems down?

:

Who calls clients?

:

Do you need to call clients?

:

Who talks to the press if it gets that far and you're on, on that level of radar?

:

Who notifies regulators if you're legally required to?

:

Most executives, if I ask that question, either go quiet or start describing

:

something that sounds like a plan but is actually a general assumption that

:

someone else has to figure it out.

:

The IT team assumes leadership will communicate.

:

Leadership assumes IT will contain it.

:

Legal assumes someone will loop them in.

:

And in the gap between all of those assumptions, a containable incident

:

becomes something probably a little bit more catastrophic than probably

:

initially would have happened.

:

So here's the harder truth.

:

The plan not existing is not the IT team's fault.

:

Incident response is not a technical document.

:

It's a business document.

:

It requires business decisions about what gets shut down, who

:

gets notified, what gets disclosed, how fast all that has to happen.

:

Those decisions cannot be made in real time by people who have never

:

rehearsed them but know their roles in them, so they cannot be made by an

:

IT team alone But before we build the framework, we need to clear something up.

:

Most people hear insider threat.

:

They picture a disgruntled employee stealing files on their way out the door.

:

So it's someone that's a bad actor with intent, someone you

:

can identify and prosecute.

:

I've actually seen that happen personally, but that is

:

probably the minority of cases.

:

The far more common insider threat is your best employee, someone who's been

:

there for years, who you trust completely, who clicked on a phishing link at four

:

PM on a Friday 'cause they were tired, and it looked legitimate, and they

:

were also ready to get out the door.

:

That employee did not intend to create an incident, but they did.

:

Insider threat does not require malicious intent.

:

It requires access and a moment of human error.

:

And since every employee in your organization has access to

:

something, whether that's email, files, systems, client data, every

:

employee is a potential threat.

:

This is not an indictment of your people.

:

This is just a statement of how incidents actually happen.

:

Not sophisticated nation-state attacks, not zero day exploits.

:

An email that looks real enough at the wrong moment.

:

I've seen some really good ones.

:

So which means that you need to have your incident response plan has to account for

:

human failure, not just technical failure.

:

And the only way to know if it does that is to test it That is

:

what a tabletop exercise is for.

:

A tabletop exercise is pretty much exactly what it sounds like.

:

Everybody sits around a table or on a conference call, Zoom, Microsoft Teams,

:

whatever, and you walk through a realistic scenario as if it's happening right now.

:

No actual systems are touched, no real data's at risk, but every decision

:

that would need to be made in a real incident gets made in real time by the

:

real people who would be making them.

:

The goal is not to just pass a test.

:

The goal is to find out where your assumptions break down before they break

:

down in the real world, in production.

:

So here's the framework.

:

Phase one, you gotta define the scenario.

:

So the scenario you're gonna pick to test is gonna be something realistic for

:

either your industry or your organization.

:

So for most small businesses, probably even large businesses,

:

that's going to be a phishing.

:

Someone on your team receives a convincing email, clicks a link, and hands over their

:

credentials without ever realizing it.

:

For Department of Defense contractors, credential, theft is a primary

:

vector, attackers targeting the access points into controlled systems as

:

well as the working environments.

:

for healthcare organizations, ransomware is a big-time one, targeting patient

:

records, which is statistically the most likely scenario you will face.

:

Start with what is most probable, but for your environment.

:

The exotic scenario is less useful than the boring one you're actually

:

likely to experience Phase two, now you've gotta assemble the right room.

:

This is where most organizations get it wrong.

:

They run the drill with IT and nobody else.

:

But a real incident touches every department in your organization.

:

IT and security handle technical containment, legal handles

:

notification requirements, regulatory obligations, and liability.

:

HR is involved the moment the incident involves an employee,

:

even an accidental one.

:

Your finance team needs to assess cost, activate cyber insurance,

:

and manage vendor communications.

:

Marketing and communications own the external message, and the executive

:

team makes the decisions that none of those functions can make independently.

:

If those people are not in the room during the drill, they will not know

:

their role during the real thing.

:

So phase three, run the injects.

:

An inject is a new piece of information introduced during the

:

exercise that changes the situation.

:

So you start with the initial scenario that somebody's credentials

:

were compromised, their login credentials to a computer system.

:

Then you add the attacker been in the environment for

:

seventy-two hours before detection.

:

Then client data may have been accessed.

:

Then word gets leaked out, and a journalist is calling for comment.

:

Each inject forces a new set of decisions.

:

Who authorizes shutting down a revenue-generating

:

system to stop the spread?

:

At what point do you notify clients?

:

How do you notify them?

:

What do you say publicly before you know the full scope of the incident?

:

These are the decisions that cause organizations to freeze during real

:

incidents, not because the people are incapable, but because they've never

:

rehearsed the decision under pressure.

:

So phase four, the communication plan.

:

This is the piece nobody builds until they are in the middle of

:

an incident wishing they had it.

:

They want that playbook then.

:

Your communication plan defines three things in advance.

:

First, the internal notification chain.

:

Who gets called first when an incident is detected?

:

In what order does that escalate?

:

What is the threshold for waking up the CEO at two AM versus handling

:

it at an operational level?

:

This needs to all be written down, not in a shared drive nobody can access

:

when the systems are down, but on a document that, that exists outside of

:

the network that's always accessible.

:

Second, you're gonna have your external notifications.

:

Depending on your industry, you have legal obligations, and this

:

clock starts running the moment you discover the breach or incident, not

:

the moment you finish containing it.

:

SEC rules require public companies to disclose material incidents.

:

DOD contractors will have those, under CMMC or DFARS.

:

And if you miss those windows because your team is focused on remediation and assumed

:

disclosure could wait, that can carry its own consequences, regulatory fines,

:

loss of contracts, in some cases personal liability for the executives who signed

:

off on the compliance to start with.

:

the responsible parties, and the draft language need to be

:

ready before you need them.

:

Third, you need to let your cyber insurance carrier know.

:

Most cyber insurance policies have specific requirements

:

about how an incident must be handled to preserve coverage.

:

Approved incident response vendors, notification timelines, documentation

:

requirements, an organization that manages an incident without following

:

their policies, procedures may have invalidated the claim at the

:

exact moment they need it the most.

:

Your communication plan needs to include a step that says, "Call

:

the insurer early before you made decisions that can't be undone."

:

Fourth, you're gonna have client and vendor communication.

:

Who is authorized to speak to clients?

:

What do you say when you don't know the full scope?

:

The answer is usually not silence.

:

Silence is a thing that turns a client into a former client.

:

Silence is always the worst thing in almost every situation.

:

Your plan needs a holding statement, a timeline for updates, and a single

:

point of contact so clients are not getting different information from

:

different people And then in phase five, you're gonna have a debrief, and

:

this is where the real value lives.

:

After the exercise, you capture everything that broke down,

:

during your table talk exercise.

:

Every moment where someone didn't know their role, every decision

:

that couldn't get made because the authority wasn't clear, every

:

gap in the communication chain.

:

Two things come out of almost every debrief regardless of the organization.

:

First, the notification chain either doesn't exist or has

:

never been communicated to the people who need to execute it.

:

Everyone assumed someone else had that list.

:

Second, leadership realizes that decisions requiring executive authority

:

have never been discussed in advance.

:

What to shut down, what to disclose, whether to pay a ransom.

:

Making those decisions for the first time during an active incident when

:

you're under pressure with incomplete information is where organizations

:

make their most expensive mistakes.

:

I've been in places where we've had communication plans very well specced

:

out, and we stored it in multiple disparate systems, so it was always

:

accessible if something happened to one of the multiple systems, and there were

:

instances where it was definitely used

:

Now I want to come back to that wire transfer from the start of the video.

:

Because before we walk through the response minute by minute, I want

:

you to hold onto something about that employee in accounts payable

:

They followed a process.

:

They did what the email asked.

:

They had no reason to believe it wasn't legitimate.

:

Tonight, they are going home carrying the weight of a financial loss that was

:

not their fault because the organization never built a verification step into

:

the workflow, never trained them on what a spoofed request looks like,

:

and never gave them a way to confirm a large transfer through a second channel.

:

That is an insider threat.

:

That is an organizational failure, and that employee deserved better.

:

Keep that in mind as we walk through the response because incident response

:

that ignores the human cost of how the incident happened will build a

:

culture where employees hide mistakes instead of reporting them fast.

:

And speed of reporting is the single biggest factor in how bad

:

something like this would get.

:

So in the first fifteen minutes, IT needs to determine whether this was a

:

spoofed email or whether the CFO's actual account has been compromised because

:

those are two very different scenarios with two very different responses.

:

While that's happening, who is making decisions?

:

Who has the authority to freeze outgoing transactions?

:

Is that IT?

:

Is that finance?

:

Is it the COO?

:

The attacker had access to the CFO's email for seventy-two hours.

:

You do not yet know what was read, forwarded, or exfiltrated,

:

the data removed from the system.

:

Who gets notified internally?

:

When does legal get involved?

:

If any of that email contained client information, and of course, the

:

CFO's email probably almost certainly does, what are your notification

:

obligations and what is your timeline?

:

The clock on those obligations started seventy-two hours ago,

:

and you're already behind.

:

You call your cyber insurance carrier now before the next decision gets made.

:

Hours two through four, you've contained the immediate breach.

:

Systems are being audited.

:

Now the external questions begin.

:

Do clients need to be notified?

:

Has this reached a regulatory disclosure threshold?

:

Is there any chance that this becomes public?

:

And if it does, who speaks?

:

What do they say?

:

By the end of the day, maybe the wire transfer is partially recoverable.

:

The reputational damage is contained because communication was handled very

:

quickly, clearly, and from a single authorized voice, or most likely it isn't

:

because nobody knew who was supposed to send the client notification, so

:

nothing went out, and a client found out from somebody else entirely.

:

The difference between those two outcomes is not technology.

:

It's

:

preparation

:

We've never had anything like that happen to us before.

:

I need you to retire that sentence.

:

it conflates not detecting something with not experiencing it, and

:

because the organizations that said it with the most confidence

:

are the ones that called me later.

:

An incident response plan is not a technical document

:

sitting in an IT folder.

:

It is a business capability.

:

It requires your executives to know their roles, your departments to know the

:

chain of command, your legal obligations to be met before the clock starts, your

:

insurance carrier is to be on speed dial, and your communication plan to

:

be ready before anyone is panicking.

:

Seen way too much panicking.

:

The tabletop exercise exists so the first time your team makes these decisions

:

is not during an actual incident.

:

It's in a controlled environment where the cost of getting it wrong

:

is a lesson, not a lawsuit or irreparable harm to your business.

:

You do not need to be a cybersecurity expert to run one.

:

You just need a realistic scenario, the right people in the room, and

:

someone facilitating who knows where the gaps tend to hide.

:

Build the muscle now.

:

The question is never if, it is always when, and whether your

:

team is ready when it gets there.

All Episodes Previous Episode

Listen for free

Show artwork for Titan of Tech

About the Podcast

Titan of Tech
Plain-English technology and cybersecurity strategy for business owners, from an independent fractional CIO.
Titan of Tech is for owners and executives of $5M to $50M organizations who want technology advice from someone who represents their interests. Not from someone who earns more commission the more licenses they sell.

I'm John Barker, an independent fractional CIO and 25-year technology and cybersecurity executive. I've led the work for federal contractors, Fortune 500s, and family-owned enterprises.

Each episode takes on a problem owners actually run into: paying for technology you don't use, outgrowing the setup you started with, or a customer, insurer, or regulator suddenly asking for proof of security. It's plain English with no vendor pitch. I don't sell tools, take commissions, or resell anything, so the advice is about what fits how your business runs.

If you want an independent voice above your IT provider, apply for a 30-minute call at https://titanof.tech.

Be the titan over your tech.

About your host

Profile picture for John Barker

John Barker

John Barker, MBA, CISSP, PMP, has worked as a Virtual CIO for the past 7 years. He has supported many executives in a wide range of industries. John's mission is to improve operational technology, identify technology value drivers, and improve cybersecurity defenses. John has led numerous cybersecurity evaluations. Using standard frameworks such as HIPAA and NIST cyber standards. John has been a regular featured columnist in Northern Virginia news outlets. He has over 35 technology columns published in the region.

John started his technology career working on Unisys mainframes in a manufacturing setting. This evolved into the lead network engineer for American Military University. The first online-exclusive accredited university in the United States. He has led a global multi-million-dollar Department of Defense technology program. That supports over 500,000 users. John advises high-net-worth families (300M+) on all technology and cybersecurity matters.

John is active in his community. John served four years in Culpeper County Broadband Planning Commission. The purpose was to expand high-speed internet access in the rural community. He has served on the Board of Directors for chambers of commerce. Served as the chairperson of marketing, and membership committees. John has been a regular at mock interviews and career days for local elementary and high schools. John has led technology entrepreneurial sessions for high school-age students. He instructs them on the steps to create a mock technology product and create a business plan. They "pitch" their ideas to other business leaders in the community.

In 2023, John served on the Technology Advisory Committee for Stafford County Public Schools. He assisted in writing the first A.I. policy voted on and approved by a School Board in the State of Virginia.

John currently works with two different cybersecurity organizations. John is a member of ISC2. He wrote new and reviewed questions for the current version of the Certified Information Systems Security Professional (CISSP) exam. This is the gold-standard information security certification. John is part of the Cyber Security Forum Initiative (CSFI.US) Cyber reporting team. The team aligns national security threat scenarios to common and uncommon cyber frameworks. The team also has access to information that cannot be disclosed.

Press List – Author
Mind-blowing AI Tools are here to stay
Date: March 4, 2023
Link: https://fredericksburg.com/opinion/comment-mind-blowing-ai-tools-are-here-to-stay/article_b603e478-b7c4-11ed-a7b0-838023b605f9.html
Category: artificial intelligence

Artificial Intelligence (AI) has seen an unprecedented leap into the public consciousness, especially with the advent of tools like ChatGPT, showcasing the potential for machines to mimic human conversation with remarkable fluency. AI's history, dating back to 1956, is built on the premise that human intelligence can be emulated by machines, leading to developments in reasoning, learning, and perception.
This technology has quietly underpinned everyday tools, from recommendation algorithms on YouTube to autonomous driving, without widespread public awareness of its mechanisms. The discussion around AI now also encompasses ethical considerations, such as the potential for plagiarism in AI-generated content and the embedding of biases within algorithms. Despite these challenges, the integration of AI into daily life and work is inevitable, urging a collective effort to harness its potential responsibly and ethically. The narrative is clear: AI is no longer a futuristic concept but a present reality, transforming how we interact with technology, understand creativity, and approach the ethical dimensions of digital innovation.

Cybersecurity is a people problem
Date: Oct 15, 2023
Link: https://fredericksburg.com/opinion/column/comment-cybersecurity-is-a-people-problem/article_042531f0-6924-11ee-8b91-fffa2f546f8c.html
Category: Cybersecurity
Cybersecurity incidents often stem from human error rather than technological flaws. For example, a major breach at MGM Resorts was enabled by social engineering, exploiting inadequate employee verification processes. Similarly, the Equifax breach resulted from unpatched servers, highlighting a lack of attention to basic security practices. Other incidents, like a casino hack via an internet-connected thermometer, illustrate the risks of integrating insecure IoT devices into critical networks. These examples underscore the importance of robust security protocols, regular updates, and education to mitigate human-related vulnerabilities. Awareness and proactive measures can significantly reduce the risk of cyber attacks.

Think Twice before using TikTok
Date: May 28, 2023
Link: https://fredericksburg.com/opinion/comment-think-twice-before-using-tiktok/article_55e76904-f3fe-11ed-b8a0-4fc03a885c17.html
Category: Cybersecurity
TikTok faces increasing scrutiny for its data privacy practices, with concerns over potential data sharing with the Chinese government due to its parent company ByteDance's ties. The platform's massive user engagement has drawn legislative attention, resulting in app bans and hearings aimed at mitigating security risks. Users are encouraged to critically evaluate their TikTok usage, considering the privacy and psychological implications of their engagement with the app.

‘Brute Force’ cellphone attack secures conviction
Date: April 22, 2023
Link: https://fredericksburg.com/opinion/columns/comment-brute-force-cellphone-attack-secures-conviction/article_0d2b4d80-ddff-11ed-8cd7-3b730ec21d54.html
Category: cybersecurity, law enforcement
At the heart of Alex Murdaugh's trial for family murder charges was a crucial cell phone video that challenged his innocence. The U.S. Secret Service's expertise in unlocking the phone revealed evidence critical to the case, showcasing the power and potential privacy concerns of digital forensic technology. This situation underscores the importance of robust personal cybersecurity measures, such as multi-factor authentication and secure passwords, to protect against unauthorized access to sensitive information.

Technology education evolving in Fredericksburg Region
Date: July 1, 2023
Link: https://fredericksburg.com/opinion/column/comment-technology-education-evolving-in-fredericksburg-region/article_248daac4-16b0-11ee-b3af-1ffb021e4fb5.html
Category: technology education

The document discusses the evolution of technology education in the region, highlighting the shift from traditional vocational programs to modern Career and Technical Education (CTE) offerings. It showcases local initiatives to engage youth in technology through summer camps and hands-on learning experiences. Programs range from building drones and gaming PCs to video game development and entrepreneurship in technology. These efforts are aimed at equipping students with industry-level certifications, real-world experience, and fostering a passion for technology from a young age, challenging them to think critically and innovatively.

Cybersecurity and the Internet of Things
Date: November 30, 2020
Link: https://www.youtube.com/watch?v=9UgaxG574TI&t=227s
Category: cybersecurity, IoT
John Barker leads a panel through a discussion of the cybersecurity risks in everyday household items that now connect to the internet.
Creating a Culture of Security
Date: Jan 23, 2020
Link: https://www.insidenova.com/culpeper/data-dump-creating-a-culture-of-security/article_6fd2bbb8-3de8-11ea-991b-9f8d164e71d4.html
Category: cybersecurity

Creating a culture of security is essential in combating the increasing threat of cyberattacks, which affect organizations of all sizes. Implementing foundational cybersecurity measures like firewalls, strong passwords, and patch management is crucial. Leadership must prioritize and practice these measures to influence the organization's culture positively. Regular training adapts to evolving cyber threats, emphasizing social engineering awareness. A non-punitive environment encourages reporting mistakes, fostering trust and improvement. External audits validate cybersecurity practices, ensuring adherence to standards. Despite existing regulations in some sectors, many companies lack comprehensive cybersecurity measures. Upcoming regulations, like the Cybersecurity Maturity Model Certification, will enforce stricter compliance and auditing, potentially extending to wider markets influenced by cybersecurity insurance trends.

Ignorance is not an excuse anymore!
Date: November 21, 2019
Link: https://www.insidenova.com/culpeper/data-dump-ignorance-is-not-an-excuse-anymore/article_a5309ae6-0c92-11ea-a3cf-e716081495ce.html
Category: cybersecurity


In recent travels and networking, a concerning trend of improperly secured websites has been observed, highlighting a persistent issue with security certificates. Many businesses, from startups to established companies, neglect basic web security, often resulting in vulnerable websites. The misconception that security breaches are unlikely and the lack of knowledge about the importance of SSL certificates contribute to this problem. It's emphasized that securing a website is a fundamental task that should not be overlooked, as it verifies the site's authenticity and secures data transmission. The article suggests actively ensuring web designers or hosting providers implement SSL certificates and explores options for securing websites, including free services. Ignorance of web security is no longer acceptable, underscoring the necessity for all, including those without technical backgrounds, to prioritize online security.

Is Your Cloud Data Safe from Prying Eyes?
Date: July 5, 2018
Link: https://www.insidenova.com/culpeper/archive/data-dump-is-your-cloud-data-safe-from-prying-eyes/article_c728ffc4-f902-5674-89be-9b178ad12ee1.html
Category: cloudy, security, privacy
The narrative explores the evolution and concerns surrounding cloud data security, focusing on encryption practices and the tension between user privacy and government access requests. It emphasizes the importance of encryption for data in transit and at rest, highlighting user control over encryption keys as critical for privacy. Major tech companies' struggle with government demands for data access is discussed, underscoring the ongoing battle for data privacy. The piece suggests that while cloud storage offers enhanced security and convenience compared to local storage, users should be aware of the potential for their data to be accessed by service providers or under legal compulsion.
Project Management Institute (PMI) Network Without Cringing (Really!) (Featured Guest)
Date: August 7, 2017
Link: https://www.pmi.org/learning/careers/network-without-cringing-really
Category: business, networking