Episode
From Security Theatre to Real Resilience: Why Most Incident Response Plans Fall Apart
- Published
- Feb 25, 2026
- Duration seconds
- 2695
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/razorwire-cyber-security-infosec-insights-5584923/episodes/from-security-theatre-to-real-resilience-why-most-incident-response-plans-fall-apart/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/razorwire-cyber-security-infosec-insights-5584923/from-security-theatre-to-real-resilience-why-most-incident-response-plans-fall-apart.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
Are you ready for the cybersecurity incident that could bring your business to a standstill? On this episode of Razorwire, I sit down with Marius Poskus, a CISO and vCISO, to tackle one of the most crucial yet overlooked aspects of information security: incident response. Whether you’re leading a cyber team, supporting your board, or simply keen to sharpen your readiness, we dig into what happens when your best defences fail and chaos strikes. We talk about what actually happens when an incident hits and why polished policies on their own aren't enough. From the practical realities CISOs face at the sharp end of an incident, through the pitfalls of security theatre, to the importance of clear communications and building resilience, we get into the lessons the playbooks often miss. Marius and I talk through wargaming, learning from unexpected scenarios and how to empower teams to make tough decisions on the fly. Key talking points: Wargaming the Unthinkable: What happens when your CEO dies? When your entire C-suite is on a plane for six hours and unreachable? When someone poisons the fish at a team dinner? Jim and Marius talk about why the most valuable wargaming exercises aren't the predictable ones. Testing unusual, uncomfortable scenarios is what exposes the single points of failure nobody thought about and builds the kind of muscle memory that no written policy can replace. Decision-making Authority in Crisis: One of Marius's contacts had a major ransomware incident and needed to hire 200 people within hours. The biggest problem wasn't the attack itself, it was getting budget approved and contracts signed fast enough. Learn why pre-agreed access to emergency funds, signing authority and the ability to bypass normal procurement processes can be the difference between…