In real incidents, the biggest delays usually don’t come from the tools or the playbooks. Your team can often figure out what needs to happen.

What’s harder is gaining the trust across organizational boundaries to make decisions and act quickly when every second counts.

The capacity of an organization to move from information to decision to action is what I think of as decision velocity.

As Stephen M.R. Covey points out in Leading at the Speed of Trust, when trust goes down, speed goes down and cost goes up.

Incident response is one of the clearest real-world examples of that principle.

Your team may already know what needs to happen, but if Ops doesn’t trust the proposed action, Legal has concerns about the implications, or business leaders aren’t aligned on the urgency, decisions stall while the attacker keeps moving.

The friction is rarely inside the security team itself. It almost always lives at the boundaries—between Security and Operations, Legal, Communications, Business Owners, and Executive Leadership.

That makes trust more than a cultural value. It is a prerequisite for decision velocity.

Building the kind of trust that allows an organization to move decisively during an incident starts long before the incident begins:

• Establish decision rights in advance. Make it clear what Security can do early and what requires approval. Authority should never be negotiated in the heat of the moment.

• Develop shared definitions. What does “high confidence” actually mean? How much disruption is acceptable? Teams move faster when they share the same understanding.

• Exercise real decisions in tabletops. Force leaders to make tough calls under pressure, not just verify who joins the bridge call.

• Build relationships across boundaries. Organizations that respond well are the ones where Security, Operations, Legal, Communications, and the business already understand each other’s priorities before anything goes wrong.

• Conduct after-action reviews that strengthen trust. Focus on fixing the system, not assigning blame.

• Create opportunities to extend trust. When Security demonstrates sound judgment and other leaders respond with support, confidence grows. So does the ability to move faster the next time.

As I’ve been thinking more about Continuous Incident Response, I’ve become convinced that decision velocity is one of its most important capabilities—and trust is one of the foundations that makes it possible.

Technology can detect. Automation can contain. But at some point, people still have to decide.

We make better, faster decisions when the people involved understand one another, know who has authority, and trust one another enough to act.

In the end, incident response doesn’t move at the speed of your technology.

It moves at the speed of your decisions.

And your decisions move at the speed of trust.