What Are the Biggest Mistakes Organizations Make When Responding to a Breach?
Having responded to hundreds of incidents, MSInfo's IR team has identified the mistakes that consistently make breaches worse. Here's what to avoid.
MSInfo IR Team · January 18, 2025 · 5 min read
After responding to hundreds of security incidents across industries ranging from financial services to manufacturing to healthcare, MSInfo Services' incident response team has observed consistent patterns in the mistakes that organizations make during a breach — mistakes that turn manageable security events into organizational crises.
The single most common mistake is acting before understanding. The pressure to 'do something' — shut down systems, reset passwords, engage vendors — is intense in the early hours of an incident. But taking actions before understanding the scope of the compromise often makes the situation worse. Reimaging a compromised system before capturing a forensic image destroys the evidence needed to understand how the attacker got in and where else they may have been. Resetting passwords before identifying all compromised accounts tips off the attacker, who then escalates from their remaining access before being cut off.
The second major mistake is inadequate scoping. Organizations often identify one compromised system and treat it as the full extent of the incident — without asking how the attacker got to that system and where they went from there. In most sophisticated attacks, the system that triggers the initial alert is not the first one compromised — it's one of many. Thorough investigation requires examining authentication logs, network flows, and endpoint telemetry across the entire environment, not just the identified affected systems.
Communication failures are the third pattern. Organizations wait too long to inform leadership — by the time executives hear about the incident, it's already in the media. Or they over-communicate sensitive details in early communications before the picture is clear, creating legal exposure. Or they forget to preserve legal privilege over their incident investigation communications by not involving legal counsel early enough.
Finally, organizations that don't conduct a thorough post-incident review are condemned to repeat the same mistakes. The post-incident review is not a blame exercise — it's a learning opportunity. What detection controls failed? What response actions worked well and which didn't? What changes to the security program would reduce the likelihood or impact of a similar incident?