A company that gets hacked but handles it well is deemed more trustworthy than a company that was never hacked at all. That counterintuitive finding from a 2020 McKinsey study changes how security leaders should think about breach preparation — not as a cost center, but as a trust-building capability. Nat Shere, Technical Services Director at Craft Compliance, brings both offensive and defensive perspectives — performing penetration tests while helping organizations build security programs. In this episode, he explains how to prepare for data breaches before they happen, why Home Depot’s breach response succeeded while Equifax’s failed catastrophically, and the two high-level metrics that every other security KPI should roll up into.
You can read the complete transcript of the episode here >
How should security leaders get executive buy-in for breach preparation?
Executives think in terms of business risk and financials. Security is typically just a cost to them. Nat recommends approaching from two angles:
- The risk angle: “It’s not if you get hacked, it’s when.” But even that framing gets deflected with “we’ll get cyber insurance.” The counter: cyber insurance premiums are skyrocketing, and insurers now require demonstrable security controls before they will pay out. You need security investment regardless of insurance.
- The revenue angle: Studies show customers increasingly choose products and services based on security and privacy posture. Being able to say “we are the most secure” is as marketable as “we are the most efficient.” Security features directly translate to revenue in competitive markets.
- Use their language: When communicating with executives, tailor your message. Do not talk about technical vulnerabilities — talk about business risk, financial impact, and competitive positioning. This is the same principle that makes risk management communication effective at every level.
What should an incident response plan look like?
Even with perfect preparation, breaches happen. The difference between a business-ending event and a recoverable one is the plan you built before it occurred.
- Build the plan before you need it. Document communication chains, technical procedures, emergency contacts, and escalation paths. An incident response plan that only exists as “we’ll figure it out” is not a plan.
- Practice at least once a year — preferably two or three times. Run tabletop exercises where all stakeholders sit in a room and walk through a simulated ransomware scenario step by step. These exercises are illuminating: you reach a point where everyone looks around and says “I don’t know what we do now.” Better to discover that in a simulation than during a real incident.
- Address both technical and communication dimensions. Technical: stop the bleeding, identify the attack vector, remediate the vulnerability. Communication: be transparent with customers, own the mistake, provide clear next steps.
- Fix the root cause, not just the symptom. Half to two-thirds of companies that experience ransomware get ransomware again because they never patched the underlying vulnerability. Stopping the immediate attack without addressing how it happened guarantees a repeat.
Why does transparent breach communication build trust?
Nat cites a McKinsey 2020 study showing that customers trust companies that were hacked but handled it well more than companies that were never hacked at all. The contrast between good and bad response:
- Home Depot (good response): CEO immediately got on media, apologized, committed to improvement, was transparent about what happened. Stock barely dipped. Today, nobody holds it against them.
- Equifax (bad response): Set up new sites that looked like phishing, was not transparent, created confusion at every step, and made things worse with each communication. Stock nosedived. The security industry still uses it as the textbook example of how not to respond.
The two rules: be transparent about what you know and what happened, and be clear with your customers about what it means for them. And one absolute prohibition: never use the phrase “we take your security seriously” after a data breach. It is the most mocked phrase in incident communication.
What are the two metrics every security team should track?
Every other security metric in your organization should roll up into these two goals:
- Increase the time it takes for a hacker to exploit a vulnerability. Fewer vulnerabilities means more time spent searching. Better controls mean more obstacles. Stronger authentication means more gates to pass. Every defensive investment should measurably increase attacker effort.
- Decrease the time it takes for security to detect an attacker (MTTD). The number of alerts matters less than how quickly you respond to them. If a penetration tester completes an entire engagement and your team says “we didn’t really see much activity” — that is a fundamental detection failure, not a quiet week.
Combined, these create MTTR (Mean Time to Recovery) as the downstream outcome. If attackers take longer to get in and defenders detect them faster, the window of compromise shrinks toward zero.
Nat’s penetration testing insight: at the end of every engagement, he provides a timeline of exactly what he did and when. The client should be able to correlate that against their security monitoring and see every SQL injection attempt, every brute force attack, every enumeration scan. If they cannot, their detection capability needs immediate attention.
How does compliance relate to actual security?
Nat is direct: security is not compliance. But compliance has a purpose.
- Compliance is the bare minimum starting point. It gives non-technical business owners a simple framework: here is ABC of what you need to do. That structure is valuable because security professionals are notoriously bad at explaining basics simply.
- Always ask “can I go one step further?” Compliance frameworks recommend 8-character passwords. Security professionals recommend 12-16. Compliance frameworks give you the floor — building above that floor is where actual security lives.
- Context determines how far above compliance you go. For external customer-facing services, you balance usability against security (a 16-character minimum might drive users away). For internal services, you can push much further because employees understand the business need.
- The right time to invest in security beyond compliance is now. Whatever you are doing today, start improving. Do not wait for an incident to justify investment. The organizations that recover fastest from breaches are those that were already investing beyond the compliance minimum.
