By Doug Howard

At 2:17 a.m., your detection and response team flags ransomware activity inside a manufacturing subsidiary. By 2:25 a.m., encryption is confirmed and spreading. At 2:40 a.m., the security operations center (SOC) lead is asking for authority to sever the plant network from the corporate environment — a decision that will halt production at three facilities. At 2:47 a.m., someone remembers the cyber policy has a notice provision, though no one on the call can say exactly what it requires. By 3:05 a.m., outside cybersecurity counsel is asking what data may have been touched and which regulatory clocks have started.

And one of those clocks matters more than the rest. If you are a public company, the moment your company determines the incident is material, the SEC’s four-business-day disclosure window opens. Which means that sometime between the encryption alert and sunrise, your CFO and general counsel are already working on questions that have nothing to do with malware: Is this material, who decides, and on what evidence?

I have spent more than three decades on the response side of the cybersecurity industry. I have worked in uniform, inside the Pentagon; at RSA Security through some of the most public breaches of that era; and currently lead the team at Pondurance — a managed detection, response, and forensics firm. 

None of the important decisions in the example above are made by technology. They are made by people, most of whom were asleep hours before the ransomware was detected. And artificial intelligence (AI) has given those people less time than they have ever had.

The tempo has changed

Attackers now use AI to automate reconnaissance, generate convincing spear-phishing at scale, produce malware variants on demand, and adapt mid-attack. The industry data confirms what my responders see in the field: CrowdStrike’s 2026 Global Threat Report puts the average time from initial access to lateral movement at just 29 minutes, down from 48 minutes a year earlier, with the fastest observed case at 27 seconds. Notably, 82% of intrusions last year involved no malware at all. Attackers are not breaking in; they are logging in with valid credentials and living off the tools your administrators already use.

The technology arms race gets the headlines. The quieter shift that I would put in front of every board is how compressed response timelines affect corporate governance. When the interval between compromise and business impact was measured in days, an imperfect escalation process could still work, although there was slack in the system. That slack is gone. Decision speed is now a security control in its own right. Decision speed is the one control that cannot be purchased.

The real exposure is coordination

Large enterprises have generally invested well in prevention and detection. What separates a contained incident from a nine-figure one is rarely a missing tool. It is the organization’s ability to make consequential decisions, in sequence, under pressure, often with incomplete information.

The military solved this problem generations ago. A pilot does not radio the Pentagon for permission to respond to a threat. Authority is delegated in advance, with clear boundaries, precisely because the moment will not wait for a meeting. Most corporations have never run that exercise for their security networks. The authority to disconnect a revenue-producing system lives somewhere on the organizational chart, and many times nobody discovers where it lives on that chart until the night it matters.

Who has authority is only the first of the series of questions that surface in the opening hours of a serious event. Another question is whether the outside counsel was engaged early enough and whether the appointment was structured correctly to preserve privilege over the forensic investigation. An important question that surfaces is whether the incident response firms being mobilized appear on the insurance carrier’s panel, or is the company about to incur seven figures in costs that may not be recoverable? Next question is, who owns the materiality analysis, and what facts does that analysis need from the technical teams that are otherwise consumed with containment?

That last question deserves emphasis, because it is where security operations and financial governance collide. The forensic picture at hour six is always incomplete, yet the disclosure decision cannot wait for a final report. Companies that have never rehearsed this handoff discover in real time that the CISO’s team and the CFO’s team do not speak the same language about the same event.

There is also the insurance dimension itself, which sophisticated risk officers understand better than most CISOs. Cyber policies commonly include consent-to-incur provisions, panel requirements for law firms and forensic vendors, and notice obligations with real teeth. Decisions made in the first hours, including which firm to call, what to authorize, and when to notify, can directly impact recovery months later. Proof of loss begins on day one, whether or not anyone is documenting it.

The response team is larger than the org chart suggests

A significant incident pulls in the executive committee and the board’s risk or audit committee, internal and outside counsel, privacy counsel, and disclosure counsel, the carrier and its claims team, forensic investigators, cloud, SaaS, and identity providers, and, on the business side, communications, HR, finance, and the operating leaders whose P&Ls are bleeding while systems are down. Each party arrives with different obligations and different assumptions about who decides what.

When that group has never worked a realistic scenario together, the opening hours are spent negotiating authority rather than exercising it. I have watched companies burn their best containment window debating whether the security team had standing to isolate systems or whether counsel needed to join before the carrier was called. The attack does not pause for the org chart to be dissected.

Three numbers from real-world engagements

Industry reports describe the trend. Our incident response casework puts hard numbers on it. Three time horizons tell the story: one hour, two days, six months.

One hour. Breakout time — the gap between an attacker’s initial access and the start of discovery and lateral movement — varies by threat actor, but with the more aggressive, less stealthy groups, we see it collapse to roughly an hour, with encryption beginning as soon as 12 hours after entry. More sophisticated actors take a different path. They dwell for 24 to 48 hours, deliberately hunting sensitive data stores or healthcare record platforms, and deploying tools built to disable endpoint protection. When they finally move, they leave with a hundred gigabytes or more. The place we see AI and automation most visibly is in ClickFix-style attacks —  a specific variant of phishing or social engineering where a user is tricked into executing the attacker’s payload themselves, typically through a fake verification prompt. CrowdStrike measured a 563% surge in fake CAPTCHA lures in 2025, and Pondurance’s caseload reflects it.

Two days. In the more sophisticated cases, backups are targeted for deletion or encryption before the ransomware ever detonates. What happens next depends entirely on maturity. Some clients shrug. They know that tested offsite copies exist, and the work becomes reaching them and starting restoration. Others discover at that moment that the destroyed backups were the only backups, or that the restoration process was never once tested and no one knows whether it will meet expectations. Even in the better cases, recovery typically begins around day two, and it takes roughly two more days to learn whether restoration is viable or the environment must be rebuilt. There is a trap inside that timeline. If restoration starts before the forensics team has established the true date of initial compromise, a company can restore from an image that already contains the adversary’s foothold and hand the intruder the environment back.

Six months. ClickFix-class intrusions plant a payload that runs quietly in the background. Sometimes it is used within days for straightforward financial fraud. Sometimes the access is sold. My team investigated an environment where the payload was deployed in January, and the network was encrypted in July by a different threat group entirely. In that case, the time from the buyer’s first access to full encryption was about four hours with data exfiltration inside the same window. The endpoint protection stopped the first encryption attempt. It failed on the second.

The pattern across all three horizons is the same. The technical clock runs in minutes and hours. The decisions that determine the outcome — isolate or observe, restore or investigate, disclose or wait — belong to executives who may be learning about the nature of these incidents for the first time.

What a tabletop exercise actually buys

A well-designed tabletop does not test technology. It tests decisions and the seams between the people who make them. The exercises that produce real value put the external parties in the room: cybersecurity counsel, the carrier’s claims representative, the forensic firm, and critical technology partners. This scenario should force the uncomfortable questions. Who is the incident commander, and what happens when the CEO starts issuing instructions around them? At what point does the materiality discussion begin, and who convenes it? Can the team communicate if corporate emails and the identity platforms are both suspect? Which systems get restored first when three business units each insist theirs is the priority? Has anyone in the room actually walked the backup restoration process, or is day two of the real event the first test?

Every one of these questions has a cheap answer and an expensive one. The cheap answer is found on an agreed-upon and pre-planned afternoon in a conference room. The expensive answer is found at 2:40 a.m., during an active encryption event or in front of regulators who will later reconstruct the timeline.

The financial case is not abstract. IBM’s 2025 Cost of a Data Breach research puts the average savings from a regularly tested incident response plan at $2.66 million per breach. This was the largest single cost reducer the study measured against a US. average breach cost that has climbed to $10.22 million. For a Fortune 500 balance sheet, the exercise is among the highest-return investments in the risk program and among the least expensive.

Where the carrier fits — and why Munich Re Specialty policyholders should act now

Cyber insurance remains the most effective instrument for transferring the financial consequences of an incident. It cannot, however, shorten operational disruption, preserve customer confidence, or accelerate a materiality determination. As AI compresses the distance between compromise and impact, the policy performs best when the policyholder has rehearsed the decisions the policy will ultimately pay for.

I will offer the underwriting community a prediction: Within a few years, decision readiness will be underwritten as directly as multifactor authentication and backups are today. Carriers already price for controls. The next frontier is pricing for how fast an insured can make material decisions in a breach event, because the loss data increasingly shows that decision latency, not tooling, drives severity. The organizations that rehearse now will not just recover faster. They will be better risks, and they will be priced like it.

This is why a tabletop exercise belongs on the calendar before renewal season, not after an event. A cross-functional exercise turns an incident response plan from a document into a capability, one that aligns the executive team, counsel, the carrier, and technology partners before the night they need each other. It surfaces the untested backup process, the ambiguous isolation authority, and the materiality handoff while the cost of fixing them is a follow-up meeting rather than a claim.

Your cyber insurance covers the financial loss. The decisions your organization makes in the first few hours determine how much there is to recover.

Munich Re Specialty encourages policyholders to regularly validate their incident response capabilities through cross-functional tabletop exercises involving executive leadership, legal counsel, technology partners, and cyber insurance stakeholders. Preparing together, before an incident occurs, remains one of the most effective ways to strengthen organizational resilience and reduce the operational impact of cyber events. Pondurance serves as part of Munich Re Specialty’s delivery team for tabletop exercises available to policyholders.

Disclaimer: The views, thoughts, and opinions expressed in this article belong solely to the individual experts interviewed and do not necessarily reflect the official policy, position, or endorsement of Munich Re Specialty. This content is provided for informational and educational purposes only. Cyber risk landscapes evolve rapidly; readers should not rely on this information as a substitute.