Compliance deserves more credit than it gets. It sets a common floor, forces documentation that disciplined teams actually use and gives leadership a language for risk. But every security team knows the uncomfortable truth: a fully compliant organisation can still have a very bad day.
The gap between the two is not a lack of controls. It is the difference between having a control and knowing it works when it matters.
Audits ask “do you have it?” Incidents ask “does it work?”
An audit checks that a backup policy exists. An incident checks whether the backup restores, how long it takes and who knows the password to the vault. An audit checks that logs are collected. An incident checks whether anyone looks at them before the damage is done.
The useful question for every control is not “do we have this?” but “when did this control last matter, and what happened?”
Measure minutes, not checkboxes
The metrics that predict how a bad day will go are about time: how long from a suspicious signal to a human decision, from a decision to containment, from containment to recovery. They are harder to collect than a list of controls, and far more honest.
Pick one of them, measure it in your next exercise and make it smaller. That is a security programme improving in a way an attacker would notice.
Rehearse before you need it
The calmest incident rooms share one habit: they have had the conversation before. Who declares an incident? Who talks to customers, and what do they say? Who can take a system offline without asking permission? Tabletop exercises answer those questions on a quiet afternoon instead of at two in the morning.
Every exercise teaches the same lesson: the plan is usually fine; the assumptions behind it are not. Finding those assumptions is the point.
Do the unglamorous work well
Most serious incidents still start with something ordinary: an unpatched system, a reused password, an account with more access than it needed, a network where everything can talk to everything. Patching, strong authentication, least privilege and segmentation are not exciting. They remain the difference between a bad afternoon and a bad quarter.
A five-minute self-test
When did you last restore a backup end to end? Could you list every system that can reach your most sensitive data? How would you find out, tonight, that an administrator account had been misused? Who would you call first? If the answers come quickly and with confidence, your programme is working beyond the checklist. If they don’t, you have found your next quarter’s priorities — before someone else found them for you.
