Written By: Frank Saulsbery
THE LATEST THOUGHTS FROM THE FOUNDER
A running column from Frank Saulsbery. Not a sales pitch, just the way he’d explain it if you pulled up a stool next to him. Meet Frank →
A SNEAK PEEK…
“The reality is that responding to a cyber incident is less about speed and more about control.”
You can almost picture how it plays out, someone clicks something they shouldn’t have, or a system starts acting strangely. Files look different, maybe something won’t open, or you get a message that doesn’t make sense. Within minutes, people are calling each other, rebooting computers, unplugging things, trying to “fix it” as fast as possible. It turns into a rush of activity, everyone means well, but it starts to feel a little chaotic.
If you’ve ever been in that situation, you know the feeling. There’s pressure to act quickly, fear about what might have happened, and a strong urge to just make the problem go away, that’s a very human response.
But here’s the part that surprises most business owners. In many cases, those quick reactions, like rebooting systems, deleting files, or trying to reload things, can actually make the situation harder to resolve. They can erase valuable information that helps determine what happened, and sometimes even make the damage worse.
The reality is that responding to a cyber incident is less about speed and more about control. Well-known guidance on cyber incidents consistently points out that the first priority is not fixing things right away. It is understanding what happened, protecting your systems from further damage, and handling the situation in a structured way. Think of it like a fire investigation. If you rush in and start rebuilding before anyone looks at the cause, you may miss something important, the same idea applies here.
What typically works best is a steady, thoughtful approach. If you have cyber insurance, one of the first calls is often to your provider. In many cases, they have specific requirements and even preferred partners who handle investigations. Skipping that step can sometimes create issues with coverage later.
If your business is regulated, there may also be rules about who you need to notify and how quickly. Those timelines can matter, so it’s worth knowing them ahead of time rather than trying to figure them out in the middle of a stressful situation.
Another piece that often gets overlooked is communication. It is very tempting to immediately notify clients or the public, but doing that too quickly can create confusion. Early information is often incomplete, a more measured approach is to prepare a clear, consistent message once you understand what actually happened. That way you’re sharing facts, not guesses.
There is also a reason many organizations bring in outside help at this stage. A forensic investigation sounds like a big, complicated term, but in simple language, it just means having someone carefully look at your systems to figure out what happened, how it happened, and what needs to be done next. This is often done before systems are restored, because once things are reset or reloaded, some of that evidence can disappear.
Security guidance often emphasizes reviewing data access, protecting sensitive information, and understanding how data moves before making recovery decisions. That is why slowing down just enough to assess the situation is so important.
So how does this apply to your business? It means that your response plan matters just as much as your prevention tools. Having a simple, clear plan in place ahead of time can take a lot of the panic out of the moment. Who do you call? What do you avoid doing? Who speaks on behalf of the company?
Without that plan, people naturally fall back on instinct, and instinct usually says, fix it fast. To be fair, not every incident turns into a major breach. Sometimes it is a false alarm or a minor issue. But treating every event with a level of care until you understand it is usually the safer path.
And it’s also okay to admit that this is not something most businesses handle every day. Calling in help when needed is not a sign of weakness, it’s often the smart move.
So here’s a simple question to think about. If something suspicious happened in your business tomorrow morning, would your team know what not to do just as much as what to do? That question alone can expose a lot.
If you want a practical next step, take a little time to outline a basic response plan. Nothing complicated. Just who gets called first, what actions should pause, and how communication should be handled.
I hope you never need it. But if you do, you’ll be glad you took a few minutes to think it through ahead of time.
That’s how I see it, anyway, and I’d enjoy hearing how you see it. None of this is a sales pitch. It’s just the kind of thing I’d talk through with you if we were sitting across the table. If it raised a question, or you think I have it wrong, I want to hear about it.
My door is always open. Whether you want to talk this through or just say hello, you can reach me anytime.
Network Solutions Unlimited is a generational managed IT services provider based in Decatur, Illinois, serving businesses and nonprofits with genuine support and decades of trusted relationships. Led by Baily Saulsbery and founded by her father Frank, we're not just your IT provider; we're your neighbors who happen to be really good at technology. Contact us today to experience IT support that actually cares.
