.webp)
A few years ago, I was pulled into an incident that started with a single customer call. The customer had logged into the platform that morning and noticed files were missing.
At first, everyone assumed it was a support issue.
Then a second customer reported something similar.
Then a third.
Within an hour, leadership was pulled into the conversation.
At that point, nobody knew whether the issue was operational, accidental, or security related.
The investigation was just getting started.
The questions started immediately:
The security team was trying to determine the scope of the issue. Leadership was trying to understand what it meant for the business.
Neither side had enough information yet.
That's one of the hardest realities of a data breach. The questions start long before the answers do.
Most people wondering what to do when you get hacked imagine forensic investigators tracking attackers through logs and systems. In reality, the first few hours are usually spent trying to understand impact quickly enough for the business to make decisions.
After being involved in enough incidents, I've noticed something that doesn't get discussed often enough.
The first 24 hours of a breach are rarely defined by the attacker.
They're defined by the decisions the company made long before the breach occurred:
The organizations that recover fastest are usually not making brilliant decisions under pressure.
They're executing decisions they already made months or years earlier.
One of the biggest differences I see between organizations is how quickly they can assemble the right people.
In mature organizations, the response begins almost immediately.
Cyber insurance is notified. Outside counsel joins the call. The incident response provider is engaged. Internal stakeholders know their responsibilities. The MSP or MSSP understands its role. Everyone starts moving in the same direction.
In less prepared organizations, valuable time is spent figuring out basic logistics.
Who owns the response? Who should be contacted? Who is responsible for customer communication? Does insurance require specific vendors?
Those questions can consume hours during a time when every minute matters.
According to Unit 42's 2026 incident response findings, attackers moved from initial access to data exfiltration in an average of just 72 minutes. Most organizations cannot afford to spend that time determining who should be on the bridge call.
This is true regardless of company size. Whether you run a 20-person professional services firm or a 500-person manufacturer, having a documented incident response plan - and knowing the data breach first steps your team will take - is what separates a contained event from a compounding one. For small businesses in particular, a lightweight incident response plan is not a luxury.
It is the difference between a recoverable incident and one that takes months to clean up.
One misconception I often hear is that incident response is primarily a technical exercise. It's not.
A breach quickly becomes a business event. Leadership needs answers. Customers may need communication. Legal obligations must be evaluated. Operational decisions need to be made. Technology teams are investigating the attacker while the business is trying to understand the impact.
This is where preparation becomes visible.
Organizations that have conducted tabletop exercises have already practiced these conversations. The scenario may not be identical, but the process of making decisions under pressure is familiar. The goal of a tabletop isn't to predict every breach. It's to ensure people know what to do when uncertainty arrives.
At some point during nearly every serious incident, someone asks the same question.
"Can we restore from backup?"
The answer is often less clear than people expect. Many organizations have backups.
Far fewer have tested them.
A breach has a way of exposing the difference between having a control and knowing it works. The same applies to endpoint protection, logging, asset inventories, privileged access reviews, and countless other security controls.
During an incident, assumptions are replaced by evidence.
The organizations that handle incidents best rarely have perfect security.
They have clarity.
They know who owns the response.
They know where their critical data lives.
They understand which systems matter most.
They have relationships with the partners they need.
They have tested the processes they expect people to follow.
Most importantly, they don't spend the first day creating a plan.
They're executing one.
If your organization discovered a breach tomorrow morning, would the first few hours be spent responding to the incident or figuring out how to respond?
Because after enough incidents, I've become convinced of one thing.
Most organizations don't discover whether they're prepared during a breach.
They discover whether they prepared before it.
This is Post 2 of 3 in TechCompass’s Breach Series. In the next post, we cover what happens after the dust settles — the hard lessons, the security gaps that get exposed, and how organizations rebuild smarter. If you missed Post 1, it covers the warning signs that are almost always present before a breach occurs.
→ Read Post 1 in Series Here: Before the Breach | Blog 3 coming next week.
.webp)
Most cyberattacks do not start with elite hackers or advanced exploits. They start with simple gaps. A stolen password. A phishing email. A forgotten backup. For many organizations, the biggest threats are ransomware, email compromise, and credential theft. The damage can be significant.
Security is not one size fits all. A 10-person startup with an MVP and a short runway should not be investing like a 5,000-person global SaaS company preparing for IPO. But too often, companies either underinvest early or throw money at tools without a plan later.
Cyber insurance used to be a checkbox. Today, it is a battleground. Carriers have tightened their requirements, premiums are on the rise, and coverage exclusions are more aggressive than ever. Many companies find themselves unprepared, with no clear roadmap on how to qualify or reduce their costs.
Is your organization prepared to handle cyber threats? From ransomware readiness assessments to virtual CISO leadership, TechCompass offers comprehensive solutions to secure your digital assets.
