Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Turn Incident Postmortems Into Strategic Assets
Transcript
- Lucas: So there's this number that's been stuck in my head all week. A study from late last year looked at how companies handle incident postmortems, and it found that organizations with a structured review process cut their rate of repeat incidents by roughly forty percent. Luna: Forty percent is huge. But I have to ask, what does a structured postmortem even look like? Because I've sat in on a few of these, and they're often just a room full of people pointing fingers. Lucas: Right, and that's exactly the problem. Most postmortems are reactive and defensive. They're about assigning blame, not about learning. But the teams that get real value out of them treat them as a strategic exercise. They're looking for systemic weaknesses, not individual mistakes. Luna: So what's the difference in practice? Give me some specifics. Lucas: Well, one big shift is moving from a linear narrative to a timeline with multiple perspectives. Instead of asking 'who did what wrong,' they're mapping out every decision point and looking at the conditions that led to those decisions. They're asking questions like, 'what information was available at the time?' and 'what pressures were on the team?' Lucas: And crucially, they're documenting all of that in a way that's shareable across the organization. Not just for the security team, but for engineering, for legal, for the C-suite. Luna: That sounds a lot like the blameless postmortem approach that came out of the tech industry, like what Google or Netflix popularized. But I imagine it's harder to do in a regulated industry where the lawyers are breathing down your neck. Lucas: Absolutely. Regulated sectors, like finance or healthcare, have to be extra careful because the postmortem can become discoverable in litigation. But that's where the strategic element really kicks in. The best CISOs are using privilege and work-product protections to keep the deep analysis confidential, while still sharing the high-level lessons broadly. Luna: So it's a balancing act between transparency and legal protection. How do they pull that off without gutting the whole point? Lucas: It comes down to separating the 'what happened' from the 'so what.' The detailed timeline, the root cause analysis, that stays protected. But the action items, the process changes, the new controls, those get pushed out across the company. You can share the lessons without sharing every embarrassing detail. Luna: And that's where the forty percent improvement comes from. Because you're actually changing things, not just filing a report. Lucas: Exactly. And one of the most telling findings from that study is that the companies that improved the most had a formal owner for each action item. They didn't just write recommendations, they assigned someone, with a deadline, and tracked it to closure. That seems obvious, but it's shockingly rare. Luna: I believe it. I've seen reports that are twelve pages of recommendations and then nothing happens. So what's the first step for a company that wants to get serious about this? Lucas: Start with a template. Have a standard structure for every postmortem. It forces consistency and makes it easier to compare incidents over time. And build a culture where people aren't punished for speaking up. That's the hard part. Luna: But that's also the part that takes the longest. You can't just flip a switch and have everyone feel safe admitting they made a mistake. Lucas: No, you can't. And that's why I think the companies that are really leading here are the ones that tie postmortems to their overall security metrics. They track things like 'time to contain' and 'repeat incident rate' and they show how postmortems are moving those numbers. That creates a business case for the program, which gets leadership buy-in. Luna: And leadership buy-in is what gets you the budget to actually fix the problems you find. It's a virtuous cycle. Lucas: Right. And I want to be clear, this isn't just about avoiding the same mistake twice. A good postmortem can surface opportunities to improve your security posture in ways you hadn't anticipated. For example, there was a major retailer a couple of years ago that had a breach in their point of sale systems. The postmortem revealed that the real issue wasn't the malware itself, but the fact that their network segmentation was so flat that the malware could move laterally almost anywhere. Luna: So they used that finding to re-architect their entire network. That's a great example of how a postmortem can lead to strategic investment, not just a patch. Lucas: Exactly. And I think that's the shift we're seeing in the industry. The postmortem is no longer an afterthought, it's a key input to the security roadmap. And with the SEC's new disclosure rules, there's also a legal imperative to do them well, because if you have to disclose an incident, you better understand it deeply. Luna: And that's a good segue, because I've been reading about how the SEC rules are forcing companies to be more rigorous about their incident response, not just for compliance but for their shareholders. Do you think that's part of why we're seeing this evolution in postmortems? Lucas: I think it's a big part of it. When you know you might have to explain to investors why your stock dropped after a disclosure, you want to be able to show that you have a handle on the situation. A thorough postmortem is part of that story. It shows you're not just reacting, you're learning. Luna: And that's a great point. And it reminds me that these conversations we have here on the show, they're really about helping people in the trenches, whether they're running a security team or building a product. You know, if you're finding value in what we're discussing, we'd love for you to support the show. It's what keeps this whole thing going, ad-free. Lucas: Yeah, that's the only reason we can have these deep dives without interruption. If you're listening and this has been useful for what you're building or running, consider buying us a coffee. It's buy me a coffee dot com slash fexingo. Luna: Even a small contribution helps us keep the lights on and the episodes coming. And we really do appreciate it. Lucas: Alright, back to the trenches. So another thing that's changing is the role of automation in postmortems. Teams are using tools that can automatically collect logs, correlate events, and even draft an initial timeline. That cuts down the manual grunt work and lets the humans focus on the analysis. Luna: That sounds like a game-changer for teams that are stretched thin. I've heard of security teams spending weeks just gathering data after an incident. If that can be automated, they can get to the 'so what' faster. Lucas: Exactly. And some platforms are even starting to integrate with project management tools, so action items from a postmortem automatically become tickets with owners and due dates. That closes the loop between analysis and execution. Luna: That's smart. But I bet there's a risk of over-relying on the automation, right? I mean, the human judgment is still the most important part. Lucas: For sure. The tool is only as good as the questions you ask. But it gives you more time to ask those questions. And that's what separates the teams that just go through the motions from the ones that are truly learning. Luna: So what's the biggest mistake you see companies make when they try to improve their postmortem process? And I'm guessing it's not the technology. Lucas: It's not. The biggest mistake is treating the postmortem as a one-time event, not an ongoing discipline. They do one big review after a major incident, and then they forget about it until the next crisis. The value comes from doing it consistently, even for smaller incidents. That's how you build a learning culture. Luna: That makes sense. It's like exercise. You can't just run a marathon once a year and expect to be fit. Lucas: Exactly. And the data backs that up. The study I mentioned earlier found that the forty percent improvement was more pronounced in companies that conducted postmortems for a majority of their security incidents, not just the big ones. So it's the repetition that drives the learning. Luna: So if you're a CISO listening to this, what's the one thing you'd say to them? What's the first step they can take this quarter? Lucas: I'd say look at your last three security incidents, no matter how small, and ask yourself: did we learn anything that we've actually implemented? If the answer is no, start there. Pick one action item, assign an owner, and track it to completion. That's the seed of a strategic postmortem culture. Luna: And if you're a security engineer listening, what can you do, even if your leadership isn't on board yet? Lucas: You can start by writing a blameless postmortem for the next incident you're involved in, even if your company doesn't have a formal process. Share it with your team. Encourage others to do the same. Change can start from the bottom up. Luna: That's a practical note to end on. And it really ties back to the bigger picture: postmortems are a strategic asset, not a chore. Lucas: And that's the takeaway. When done right, they don't just prevent repeat incidents, they make your whole security program smarter. And in a world where attackers keep evolving, that learning capability is your real edge.