Clear head, cold blood: managing panic during a cyber incident

Every pressure tactic in a cyber incident — the ransom countdown, the threat to call your customers, the "pay now or the price doubles" — targets the same vulnerability: a human brain flooded with adrenaline makes fast, narrow, reversible-feeling decisions about irreversible things.

Calm is not a personality trait here. It is a set of mechanical practices that work whether or not you feel calm — and the evidence they protect is often the difference between a recoverable incident and a permanent loss.

Do this now

1. Buy ten minutes. Before any decision: slow physical breathing — long exhales — until your heart rate settles. Almost nothing in a cyber incident becomes worse in ten minutes; decisions made inside the adrenaline spike routinely do.
2. Give the crisis a structure. Name one lead who decides, one scribe who logs, one person who communicates — even in a three-person company. Under stress, unowned tasks silently vanish and duplicated ones collide.
3. Switch from memory to checklist. Use a written runbook or the advisory for your incident type on this site. Externalized steps beat improvisation under stress — that is why pilots, surgeons, and responders all fly checklists.
4. Set a decision rhythm. Regroup at fixed intervals — every 30 or 60 minutes — instead of reacting continuously. A cadence converts an unbounded emergency into a series of bounded, decidable questions.
5. Control the information flow. One channel for incident facts, scheduled updates for wider staff, and an explicit no-rumor rule. Uncertainty spreads faster than malware and does its own damage.
6. Plan rest from hour one. If the incident will outlast a workday, rotations are containment too. Exhausted people wipe the wrong server with total confidence.

What not to do

• Do not make irreversible calls — paying, wiping systems, public statements — in the first thirty minutes.
• Do not hunt for the person who clicked the link; you need their honest account more than their apology.
• Do not let everyone "help" on affected systems; well-meant activity destroys evidence.
• Do not narrate worst-case scenarios in the incident channel — log facts, assign questions.
• Do not hide the incident from the people who will have to know; late honesty compounds every cost.

Preserve the evidence

Whatever else happens, these are the artifacts the investigation — and any insurance claim, dispute, or prosecution — will be built from:

• Panic is the leading cause of evidence loss: rebooted machines, wiped disks, mass password resets before capture.
• The shared incident log doubles as both anxiety regulation and the legal record of your response.
• Fixed decision points create timestamps investigators and insurers later rely on.
• A no-blame rule surfaces the first-click account early — often the single most valuable fact in scoping.

Keep a clear head

Tunnel vision, irritability, insomnia, replaying events on a loop — during and after an incident, these are normal responses to an abnormal event, not signs you are failing. They fade as the situation stabilizes. If they persist after the incident ends, talking to a professional is standard practice — emergency services debrief for exactly this reason.

If you personally clicked the link, took the call, or approved the transfer: you are the key witness, not the culprit. Attacks are engineered by professionals to defeat exactly the checks you were running. Reporting fast is the one move that reliably shrinks the damage — silence is the only unforgivable click.

Questions victims ask