Steve Hodges
Cybersecurity leadership, decision velocity, trust, and continuous incident response.
Category: Decision Velocity
-
In real incidents, the biggest delays usually don’t come from the tools or the playbooks. Your team can often figure out what needs to happen. What’s harder is gaining the trust across organizational boundaries to make decisions and act quickly when every second counts. The capacity of an organization to move from information to decision…
-
As adversaries move laterally in seconds, detection alone isn’t enough. We must also optimize how fast we can decide. Recently, I wrote that IR must evolve from an episodic process to a continuous operating capability—because modern threats outpace traditional structures. Speed isn’t generated only in the SOC. It’s forged in governance. We’ve invested years in…
-
27 seconds. That was the fastest observed breakout time for an intrusion in 2025. Not 27 minutes. Not 27 hours. 27 seconds.