The article rightly stresses speed, but the deeper management issue is command structure. In the first two hours, the technical response can easily become fragmented: infrastructure teams try to restore service, security teams try to preserve evidence, legal teams try to control disclosure risk, and business leaders want immediate answers. Without a preassigned decision hierarchy, those objectives can collide. The real differentiator is not simply having an incident response plan, but defining who has authority to approve containment, isolation, shutdowns, external communications and restoration sequencing when facts are still incomplete.
That also changes how leaders should think about resilience investment. Backup coverage alone is a misleading metric if recovery validation, immutable copies, privileged-access controls and clean-room restoration are weak. The source highlights backup testing; for CIOs and operations leaders, the practical extension is to treat recoverability as an operational capability with evidence, not an assumption. Board-level cyber preparedness should therefore ask: how quickly can we establish trusted communications, identify decision-makers, verify backup integrity and restore priority services without reintroducing compromise?
A useful discipline is to define the first two hours as a business continuity exercise as much as a security event. That means maintaining an offline contact tree, external counsel and specialist retainer arrangements, a ranked application recovery order and prebuilt crisis communication channels that do not depend on the potentially compromised estate. Organizations that rehearse these decisions cross-functionally are more likely to reduce both downtime and legal exposure, because they avoid the classic trap of optimizing for speed while undermining evidence, compliance and long-term recovery.
In the minutes after a cyberattack, everything blurs. Core systems go down, email is frozen or unsafe, and incident response teams must act swiftly to mitigate the damage and prevent more of it.
Bad actors aren’t the only threat to an organization under attack, however. Incident response team members who make poor decisions in the crucial first two hours can add to the chaos and turn an expected five-day recovery into a five-week crisis. Sometimes, they cause more technical damage and legal risk than the hackers themselves.
The first 120 minutes determine recovery time
The first two hours should be spent assembling the response team. That starts with contacting breach counsel, even at 3 a.m. Once engaged, forensics, restoration experts, negotiators and the client’s main point of contact are brought together to scope the incident. Next, establish secure channels for urgent and non-urgent communication, such as Signal and temporary email accounts, especially for breaches that compromise email systems.
Related:5 CISO principles for navigating cybersecurity incident disclosure
From a technical standpoint, companies should implement security hardening measures promptly to reduce the risk of a repeat attack during recovery. They should also launch a full investigation to determine which systems were breached, how much data was stolen and how criminals carried out the attack. If the attack involves ransomware, the company should hire trained negotiators who can communicate with the criminal group, and restoration specialists who know how to unravel corrupt and encrypted systems.
Most breaches quickly evolve from a technical problem to a legal, operational and financial crisis. That’s why response teams should first call a breach counsel attorney to help assess their legal liability, solidify attorney-client privilege and lead the notification process if needed.
IT teams can’t fall back on their training
Navy SEALs are known for saying, "Under pressure, you don’t rise to the occasion. You sink to your level of training." For a highly trained elite team like the SEALs, that phrase is a motivator. For an in-house IT team responding to a cyber incident, however, falling back on training could make things worse.
That’s because the tool IT teams use pragmatically to solve most routine failures — wiping data and standing up a new system — is the wrong approach post-breach. Following through on that instinct might seem logical, but it can make recovery dramatically harder. Teams could destroy vital evidence, leaving the actual vulnerability open. If they build a new system on top of a backdoor the attacker left behind, the same incident will happen again.
Related:AI disaster recovery planning is years behind AI adoption
Can you rely on your backups?
Rapid and successful incident response comes not from wiping compromised systems clean, but by restoring trusted backups. While most businesses back up their data across redundant systems, the harsh reality is many backup systems are unreliable during recovery and rarely tested prior to breaches.
There are 33 ways a backup system can fail to recover. Only one is sabotage. Eight more reveal themselves through routine monitoring. The other 24 are dormant faults that are essentially invisible, even to IT teams.
The only way to find these hidden failure modes is by doing routine recovery testing. Ignoring this crucial step is similar to letting an emergency generator sit idle for years until a power outage hits. The generator may fire up, but the odds are not in your favor.
IT leaders must also understand that even the strongest security posture isn’t enough to prevent a breach. That is why organizations must also implement continuous monitoring across their entire environment. Without continuous monitoring, cybercriminals can sneak in a backdoor and remain in a system for days or weeks before deploying an attack, leaving the organization vulnerable.
Related:Why disaster recovery plans fail in geopolitical crises
In cyberattacks, company size doesn’t matter
While some companies believe they are too small to be hacked, or that their data isn’t vulnerable enough, real-world evidence tells a different story. While we have seen criminals target underresourced industries, including manufacturing, law firms, CPAs, government agencies and school districts, we also see many attacks in highly regulated sectors like healthcare.
Additionally, threat actors are indiscriminate in their attacks. Most breaches today begin as automated attacks, where bad actors use AI at scale to detect vulnerabilities in firewalls or other Internet-facing systems, then attempt to exploit them regardless of the business type or size. These AI-driven intrusions are carried out by perpetrators and access brokers who gain initial access to an environment and then sell that access to criminals who carry out the strike.
Given the widespread risks, organizations would be wise to have relationships with incident response partners before ever needing them. The best firms will be on call 24/7 and know how to immediately activate the right team, coordinate breach counsel, establish secure communications and, perhaps most importantly, prevent well-intentioned decisions that can delay recovery by weeks.
Most organizations focus on preventing cyberthreats but underinvest in recovery planning. The first two hours after a ransomware attack, however, are when decisions, leadership and planning matter most. The organizations that recover fastest are those that mobilize quickly and follow established best practices for containment and restoration.
What are your tips for the first two hours after a cybersecurity incident? Share them: [email protected].
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.