Staunching Wounds and Staying Sane: A Survival Guide for Incident Responders

The talk frames incident response as a customer-service role as much as a technical one, drawing parallels to emergency medicine. The speaker, an IR consultant, compares the range of cases a response team sees, from mailbox compromises and vendor-related scares to ransomware and nation-state intrusions, with the spread of patients an emergency department handles. Each case needs a different level of triage and commitment, and treating even minor callers well keeps them coming back.

Much of the practical advice centers on scoping calls, where the team learns the client's history and goals and sets realistic expectations about what can be known. The speaker covers keeping responders rested and documenting their work, staffing analysts by strengths and avoiding overload, and coordinating with threat intelligence, public relations, legal counsel, HR and recovery partners. For upset clients, the approach is to keep communication frequent, be blunt when a stressed contact is overwhelmed, and give conservative estimates, then deliver ahead of them.

On the technical side, the speaker stresses prioritizing evidence requests so that short-retention logs are not lost, avoiding rabbit holes, and isolating network segments quickly when malware is spreading, even at the cost of business downtime. Sometimes restoring operations matters more than complete forensics. The talk closes with using a painful incident to win budget for logging and tooling, plus tabletop exercises. The main takeaway is that responders cannot control attackers or client temperament, but they can manage their own team and communication.