For a lot of small business owners, cybersecurity only becomes a priority once something has already gone wrong, by then, the damage is usually done.
Ransomware, phishing scams and data breaches can hit without warning, and the businesses that recover fastest are almost always the ones with a plan already in place before the incident happens. That means knowing who to call, what to lock down, and how to keep operating while the issue gets sorted.
In this week’s Let’s Talk, we put that question to our panel of experts: what cyber incident response steps should every business have ready, before something goes wrong.
“Most organisations discover gaps in their incident response plan during the incident itself, the most expensive time to learn them. A mature readiness posture starts well before any alert fires. It requires a documented and tested response plan with clear severity tiers, a named response team across technical, communications, legal and executive leadership, pre-approved playbooks for scenarios such as ransomware, data exfiltration and business email compromise, and an out-of-band communication channel if primary systems are compromised.
Equally critical is knowing whether detection and containment capabilities are ready in practice, including log retention, EDR coverage, network segmentation options and backup integrity, and validating them through regular tabletop exercises, not simply documenting them.
The organisations that recover fastest treat incident response as a muscle, not a document. That means quarterly simulations, pre-negotiated relationships with forensics and legal partners, and a communications plan for regulators, customers and the board.
After an incident, a genuine lessons-learned process, not a blame exercise, closes the loop and feeds improvements back into the plan.
Readiness is not about eliminating risk; it is about compressing the time between detection and controlled recovery, a leadership discipline as much as a technical one.”
“Every leader I speak with across APAC and Japan asks the same question after an incident: “Could we have been readier?” The honest answer is almost always yes, and the gap is preparation.
“Scams no longer announce themselves. They arrive through a convincing invoice, a spoofed executive voice, a moment of trust exploited at speed. By the time an alert fires, the decisions that matter most are already made, or left unmade. Cyber Scam Awareness Week reminds us that resilience is not built in the middle of a crisis; it’s built in the quiet before one.
“So, what should every organisation have ready before something goes wrong?
“A decision map, not just a plan. Know who has the authority to contain, notify and speak before the clock is running.
“Rehearsed muscle memory. Plans tested through tabletop exercises, with business leaders in the room, not only technical teams, become instinct.
“A communication line already open. Internally and with regulators and customers, because silence reads as concealment.
“Restoration you have actually proven. Because a backup you have never recovered from is a hope, not a control.