Panic Is a Planning Problem

Published: Oct 7, 2026 

When security is built into how you run the business, an attack becomes something you respond to instead of something you survive.

Picture two companies hit by the same phishing email on the same Tuesday morning.

At the first, an employee clicks, and by lunch the leadership team is crowded into a conference room. Who do we call? Does our insurance cover this? Are the backups any good? Who's allowed to talk to customers? Because there is no plan, no one has the answers, so everyone scrambles.

At the second, the same click triggers an alert someone is watching. Maybe it's their internal SOC, maybe they have a trusted partner. The affected account gets locked, the incident lead pulls up a plan the team rehearsed that spring, and the first five calls go out in the order they were written down and practiced. By afternoon, the incident is contained and documented, and it's business as usual.

Same attack, different outcome. The second company didn't have a bigger budget or better luck but it did have a foundation, built ahead of time, and it's the difference between being prepared and being scared.

That's the theme of our Cybersecurity Awareness Month series this October: prepared isn't scared. This week, we're starting with the fundamentals that let you face a threat with calm and a plan instead of panic. At the end, you'll find a checklist to take back to your own environment.

Whack-a-Mole Isn't a Strategy

Most organizations don't set out to run security reactively, it happens to them one fix at a time.

For example, a customer questionnaire asks about MFA, so MFA gets turned on for email. Later, a peer company gets hit with ransomware, so a new endpoint tool goes in. When the insurance renewal a month later asks about training, someone buys a training platform. Each decision makes sense in the moment and solves a real problem but even taped together, they still don't form a program because there's nothing ties them to a strategy.

The whack-a-mole approach, swinging at whatever pops up and waiting for the next one, may keep the business running but it creates three problems.

1. No one can say with confidence where the information assets are and what they're connected to, or where the biggest risks are, because no one has looked at the entire environment.
2. Spending grows without a clear sense of what it's buying.
3. When something gets through, there's no plan, so the response is improvised under pressure, creating fear and panic.

Treat Security Like the Business Investment It Is

The organizations that don't panic or suffer days of downtime are the ones that make an early decision to treat cybersecurity as an investment in the company's ability to grow.

These organizations talk about cybersecurity in their strategic planning (and spending) conversations early. They evaluate all their vendors for security risks, they know what systems and data each one has access to, and they get the appropriate agreements in place before they sign a new contract. When they open a new office, roll out a new application, or let employees start using an AI tool, someone asks what it does to their risk before it goes live. They budget for security the way they budget for sales or operations, against a plan, instead of finding money after a scare. And when a cyber insurance application or a customer's security questionnaire lands on someone's desk, they answer from documentation, not memory, because the work is already done.

Investments are matched to a budget sized to the risk, an owner accountable for results, a roadmap with milestones, and regular reporting on whether it's paying off. If your cybersecurity program isn't getting the same treatment, it will fall short.

"Right sizing the cybersecurity budget is the first decision, and every decision after it depends on getting that one right."

— Jeff Buss, CEO, Cyberleaf

Build the Foundation Before You Need It

A strong foundation has three parts, people, process, and technology, and all three start from the same place: an honest look at your risk.

Start With an Annual Risk Assessment

You can't protect what you can't see. A risk assessment answers the questions whack-a-mole never gets to. Like, what data do you hold, and where does it live? Who can reach it? What would hurt most if it were lost or exposed? How do your current controls measure up against a recognized framework like the NIST Cybersecurity Framework?

The output should be a prioritized roadmap that tells you which gaps to close first, what can wait, and where your next dollar will do the most good. Do it every year, because your business changes every year. New hires, new vendors, new cloud apps, and new AI tools all shift your risk and your annual risk assessment should account for that.

People

Every control depends on someone. Start with ownership: one named person should be accountable for the security program, with the authority and budget to act. In a lot of growing companies, that person doesn't exist yet, or it's an IT lead with security added to an already full plate. A virtual CISO is one way to fill that seat without a full-time executive hire.

Beyond ownership, your team needs to know what's expected of them. That means training that happens more than once a year, and a clear, judgment-free way to report something suspicious. Every single employee in your organization plays a role in keeping the organization's data and systems safe, every person should understand this and know their role. Additionally, you should have a designated team with named roles for what happens during an incident, including the outside partners you'll lean on, like your incident response firm, legal counsel, and insurer.

Process

Process turns good intentions into repeatable behavior. The core ones cover incident response, patching, access for people who join, change roles, or leave, vendor risk, and business continuity and disaster recovery.

Documenting them is step one, but practicing them is what makes them work. A tabletop exercise walks your team through a realistic scenario, like ransomware or business email compromise, so the first time you run your plan isn't during a real incident. If you do not practice your plan, adrenaline will render your team ineffective in a real crisis. Your business continuity and disaster recovery plan deserves the same rehearsal, and we'll go deep on that in week three.

Technology

Technology is where most companies start, and it's often where they stop. And while tools matter, they must be configured correctly, deployed everywhere they need to be, and watched by someone who can act on what they find in order to really hold their place in your strategy. We've written before about the validation gap, like MFA with exceptions, endpoint protection that isn't running on every server, alerts no one reviews, or backups no one has restored.

The foundational controls aren't exotic. Enforce MFA everywhere, keep systems patched, run endpoint detection and response on every device, monitor around the clock, and keep isolated, tested backups. Then confirm each one is working, on a schedule. Or let one of our security practitioners do a free Coverage Check with you, which shows how much of your environment those tools protect today.

Documentation Holds It All Together

Documentation is the least exciting part, it's tedious and boring, but it pays off when it matters most. Written policies tell your team what to do while records of training, testing, access reviews, and remediation prove you did it. When an insurer investigates a claim, a customer sends a questionnaire, an auditor asks for evidence, or a buyer runs diligence, documentation turns "we have that" into an answer your organization can really stand on.

It also keeps people calm. With a documented plan, no one has to remember the right steps in the middle of an incident.

What Prepared Looks Like When It Counts

No foundation can stop every attack, but it changes what happens next.

That last row really matters because prepared organizations treat every incident, drill, and near miss as input for next year's risk assessment, so the foundation gets stronger over time instead of patchier.

The Prepared Isn't Scared Checklist

Use this cybersecurity checklist to take a clear look at your own environment. Every box you can't check is a gap to put on your roadmap. If you'd like a hand, one of our security practitioners will walk through it with you for free.

Risk

☐ We've completed a risk assessment in the past 12 months, measured against a recognized framework.

☐ We know what sensitive data we hold (client, employee, financial, intellectual property) and where it lives.

☐ Assessment findings are on a prioritized roadmap with owners and target dates.

☐ Leadership has reviewed the results and agreed on how much risk the business is willing to accept.

People

☐ One named person owns the security program and has the authority and budget to act.

☐ Employees get security awareness training and phishing simulations more than once a year.

☐ Everyone knows how to report something suspicious, and nobody gets punished for reporting.

☐ Incident roles are assigned, with a backup for each, and outside partners (incident response, legal counsel, insurer) are lined up in advance.

☐ We know who has access to what, and access changes when people join, change roles, or leave.

Process

☐ We have a written incident response plan, and we've run a tabletop exercise against it in the past 12 months.

☐ We have a business continuity and disaster recovery plan with defined recovery targets, and we've tested it.

☐ Systems get patched on a set schedule, and exceptions are tracked.

☐ Vendors with access to our systems or data get reviewed before onboarding and at least once a year after.

☐ Security policies get reviewed and approved by leadership every year.

Technology

☐ MFA is enforced on every account and system, including admin accounts, remote access, email, and cloud apps, with no standing exceptions.

☐ Endpoint detection and response runs on every workstation and server, and we've confirmed it.

☐ Alerts are monitored around the clock by someone who can investigate and act.

☐ Backups are isolated from the main network, and we've restored from them in a test.

☐ We keep a current inventory of devices, software, cloud services, and AI tools in use.

Documentation

☐ We can produce evidence of our controls (reports, logs, training records, test results) when an insurer, auditor, or customer asks.

☐ The answers on our cyber insurance application match what's in place today.

☐ Our first-five-calls list is written down and stored somewhere we can reach if our systems are down.

☐ Leadership gets a regular report on progress against the security roadmap.

Confidence Is Never an Accident

If you checked most of those boxes, you've built the foundation. Nice job! Now you have to keep it current. If you can't check most of these boxes, now you know where to start.

The goal isn't perfection, it's knowing where you stand, having a plan for what comes next, and being able to prove both. That's how prepared organizations face a threat without fear and get back to growing the business.

Prepared organizations still get attacked. The difference is they aren't caught off guard.

Want a second set of eyes on your results? Book a free half hour with one of our security practitioners and see where you stand. Book Your Free Coverage Check →