Leadership and chaos: 5 mistakes we always see in a cyber crisis
There are moments when everything speeds up. An alert goes off. A service collapses. Nothing responds anymore. And then everyone turns to "management".
There are moments when everything speeds up. An alert goes off. A service collapses. Nothing responds anymore.
And then everyone turns to "management".
That is often the moment you grasp something essential: leadership is not measured by the PowerPoints of normal times, but by the silences of a crisis.
Here are five mistakes I see regularly. And what they quietly reveal about our relationship with responsibility.
1. Speaking too late, or saying nothing at all
In the first hours, silence is a poison. It leaves room for rumours, for anxiety, for internal paranoia.
You do not need all the answers. You need to say what you know, what you are doing, and when you will know more. An imperfect word beats an absence of direction.
Internal communication is not an option. It is a tool for stabilisation.
2. Handing reality over to the provider
"The managed services provider has it." "We are waiting for the CERT report." "The CISO is handling it."
No.
In a crisis, you are exposed. Your organisation. Your image. Your customers. You cannot outsource your responsibility even if you have outsourced your infrastructure.
Leadership means staying present. Asking questions. Making the calls. Carrying the message.
3. Clinging to processes, ignoring the team
Many crisis plans look like aircraft flight manuals. Complex. Unusable in flight.
In reality, a crisis is people under pressure, working with partial information, who have to improvise fast and well.
If you only watch the metrics, you miss the state of your troops. The fatigue. The panic. The fog.
A good leader does not just manage the incident. They keep an eye on the nervous strain. They support, steady and calm. Not in guru mode. In useful mode.
4. Hunting for someone to blame while the fire is burning
This reflex runs deep. Looking for who clicked. Who approved. Who mishandled it.
But in the thick of a crisis, this need to point fingers slows everything down. It blocks communication. It silences the weak signals. It isolates the good instincts.
The time for the after-action review will come. But during the storm, you manage. Together. Then you learn.
5. Wanting to understand everything before deciding
The fantasy of "zero risk" drives inaction. You want more information, more sign-off, more analysis. Meanwhile, the situation spirals.
An imperfect decision now is often better than an excellent decision too late.
Leadership is not about knowing everything. It is about setting a clear direction, even a provisional one, so others can act.
What I take away, every time
A crisis reveals. Not the CVs. Not the org charts. The postures. The fears. And the ability to stay useful when everything shakes.
What we call "leadership" has nothing mystical about it. It is a human skill. Accessible. Trainable. Indispensable.
But it cannot be improvised.
Discover my appearances in the media
Questions fréquentes
Why is silence dangerous in the first hours of a cyber crisis?
Because it leaves room for rumours, anxiety and internal paranoia. An imperfect word, saying what you know and what you are doing, is better than an absence of direction.
Can crisis management be delegated to your provider or to the CISO?
No. Outsourcing the infrastructure does not outsource the responsibility. The leader stays exposed for their organisation, their image and their customers, and must stay present to ask questions and make the calls.
Should you look for who is responsible for an incident during the crisis?
No. Hunting for someone to blame while the fire is burning slows everything down, blocks communication and silences the weak signals. The after-action review comes after the storm.
Do you need to understand everything before deciding in a crisis?
No. The fantasy of zero risk drives inaction while the situation spirals. An imperfect decision now is often better than an excellent decision too late.
Is crisis leadership an innate gift?
No. It is a human skill, accessible and trainable, but it cannot be improvised. A crisis reveals your posture and your ability to stay useful.
L’auteur
Christophe MazzolaJ’écris sur la cybersécurité telle qu’elle se vit vraiment : gouvernance, facteur humain, et tout ce que les rapports d’audit n’osent pas dire au COMEX. Auteur de « Être en cybersécurité ».
Être en cybersécurité
Une feuille de route cyber en clair, pour tout le monde, pas seulement les experts.