John Z Black
Brunswick, ME • (207) 245-1010 • contact@johnzblack.com
Every breach gets the same first question: who did it? Useful, but incomplete.
Recent incidents across vendor exposure, insider abuse, and nation-state-linked activity show the same business outcome: legal risk, trust damage, operational disruption, and executive pressure.
Attribution belongs in the briefing, but control failure belongs at the center. Separate the two every time:
- Who likely carried it out
- Which control failed or was missing
That shift keeps remediation grounded in reality instead of headlines.
The response playbook is also consistent across attacker types: establish facts quickly, preserve timeline integrity, coordinate legal-security-comms early, notify stakeholders on time, and document corrective actions leadership can govern.
If your response model only works against the attacker you expected, it is not resilience. It is optimism with a slide deck.