Why incident response breaks down when it matters most

In this Help Net Security video, Jon David, Managing Director, NR Labs, discusses why incident response often breaks down during a breach. Drawing on years of experience watching real attackers operate across many industries, he walks through what tends to fail once pressure sets in.

He explains how hesitation, poor escalation, and weak communication allow attackers to move faster than defenders. The discussion focuses on how trust, connectivity, and human behavior are often exploited more than tools.

David outlines why teams struggle to activate response plans, how alert overload slows decisions, and why executives often lack the information they need. He also covers the risks of acting too early or too late, especially when evidence is lost.

The video closes with practical guidance on preparation, including exercises that bring security teams, leadership, legal, and communications together before an incident happens.