In a cyber crisis you will act on incomplete, contested, time-pressured information. This lesson is about deciding well anyway — the process a leader sets before the crisis, not the guesswork during it.
Day 3DecisionsCrisis leadership
Notes: The pivot from systems to judgment. The message: you can't remove uncertainty, but you can decide well within it.
Lesson 13 · Slide 2
You will decide before you are sure
Information is incomplete — you never have the full picture in time
It is contested — attribution and facts are disputed (recall Lesson 02)
It is time-pressured — waiting is itself a decision, with consequences
So the goal is not certainty; it is a good decision under uncertainty
The reframe
Demanding certainty before acting is a decision to be slow. Often the cost of delay exceeds the cost of being partly wrong.
Notes: Reveal each. Callback to Lesson 02: attribution is often wrong and always contested, yet you must still act.
Lesson 13 · Slide 3
Set your risk appetite in advance
Risk appetite — how much risk you'll accept in pursuit of your goals
Risk tolerance — the limits you will not cross, decided when calm
Pre-deciding these stops each crisis becoming an improvised argument
Why it matters
If you define your thresholds only in the moment, the loudest voice or the worst fear decides for you.
Notes: Risk appetite is a governance artifact (ties to Lesson 14). Decided in advance, it anchors decisions when adrenaline is high.
Lesson 13 · Slide 4
Biases that bite in a crisis
Confirmation bias — seeing only what fits your first theory
Anchoring — over-weighting the first number or claim you heard
Sunk cost — throwing good resources after a failing course
Groupthink — the room converging to avoid friction
Normalcy bias — "this can't really be happening to us"
Notes: Reveal each. These are predictable, so they're counterable. Normalcy bias is especially dangerous early in an incident.
Lesson 13 · Slide 5
Counters you can build in
Devil's advocate — appoint someone to argue the opposite
Pre-mortem — "it's six months on and this failed — why?"
Name the base rate — what usually happens in cases like this?
Separate evidence from inference — what do we know vs what do we assume?
The move
You cannot will bias away, but you can install rituals that surface it. Build them into how the crisis room runs.
Notes: Reveal each. "Separate evidence from inference" echoes Lesson 02's CTI reading — the same discipline applied to decisions.
Lesson 13 · Slide 6
Decision tempo: the OODA loop
Observe, Orient, Decide, Act — then observe again. Press →.
Observe — gather what you can
→
Orient — interpret, check biases
→
Act on an unchecked assumption — the failure
→
Decide & act — then observe the result
Good-enough, now
A sound decision made in time usually beats a perfect one made too late. Cycle fast; correct as you learn.
Notes: Reveal step by step. The hot node is the trap — skipping "orient" and acting on assumption. OODA's value is fast iteration, not one perfect call.
Lesson 13 · Slide 7
Reversible vs irreversible
Reversible calls
Decide fast, learn, adjust. Protective, undoable moves can be made on partial information.
Irreversible calls
Slow down. Public attribution, paying, major disclosures — get more certainty before you commit.
Notes: A practical heuristic: match your speed to reversibility. Take reversible protective actions early; reserve deliberation for the one-way doors.
Lesson 13 · Slide 8
Mid-board-meeting, you get an ambiguous alert of a possible breach. What do you do first?
C. A (wait for certainty) lets damage spread while you seek proof; B (announce a major breach) is an irreversible move on unverified information; D (assume false alarm) is normalcy bias. C matches speed to reversibility: take an undoable protective action now, and verify at the same time. You keep options open and lose nothing if it's a false alarm.
Notes: The two failure modes are paralysis (A/D) and panic (B). The disciplined answer takes reversible action while investigating — no regret either way.
Lesson 13 · Slide 9
Communicating uncertainty
Say what you know, what you don't, and your confidence
Don't over-claim early — you will have to walk it back
Boards and stakeholders trust honest uncertainty over false precision
Leadership move
"Here's what we know, what we're still verifying, and what we're doing meanwhile" is the most credible thing you can say in a crisis.
Notes: Reveal each. Ties back to Lesson 02: don't let contested attribution become an over-claim. Calibrated honesty preserves credibility.
Lesson 13 · Slide 10
Two-minute drill: your decision checklist
Write your personal checklist for a high-uncertainty cyber event: what you must know before acting, which bias you're most prone to, and your default reversible first move.
Notes: Start the timer. A pre-written checklist is what keeps a leader between paralysis and panic when the alert is real.
Lesson 13 · Slide 11
Recap & what's next
You'll decide before you're sure; pre-set risk appetite and counter your biases
Cycle fast (OODA); match speed to reversibility; avoid paralysis and panic
Communicate calibrated uncertainty — it beats false precision
Next
Lesson 14 — Operating Model & The Questions To Ask: how to govern security so good decisions are the default.
Notes: Bridge: good crisis decisions rest on a good operating model built in peacetime — the next lesson.