Background

I’ve always admired the unmistakable WiCyS energy — that rare blend of candour, competence, and community. 🤍

Last week, I attended my first in-person event hosted by the Professional Affiliate of WiCyS UK & Ireland at the Barclays office, and it truly lived up to that spirit.

The panel discussion, “The Gap Between Detection and Decision: AI Raises the Alert. Ransomware Forces the Choice.” could not have been more timely.

The panel itself reflected a thoughtful balance of technical depth, strategic clarity, and composed leadership, exactly the kind of presence one hopes to see in a crisis room. The dialogue was open, nuanced, and refreshingly candid. 🎙️✨

A few reflections stayed with me long after the evening concluded:

💫 Cyber crises are socio-technical events

There is increasing recognition that ransomware — and escalated cyber crises more broadly — are complex socio-technical challenges.

Managing them requires more than technical rigour. It calls for calm judgement and deliberate decision-making based on the information available at the moment of identification.

Detection may be automated. Response is human. 🧠⚡

🔥 Preparedness is discipline, not theatre

We practise fire drills to understand exits before smoke fills the room.

Cyber drills deserve that same seriousness. Simulations are not performative exercises — they build readiness, role clarity, and the composure needed when situations escalate.

Preparedness shapes confidence. Confidence shapes response. 🛡️

⚖️ The ransom dilemma

The decision to pay — or not to pay — is layered, even if it ultimately results in a binary outcome.

Beyond operational recovery, there are ethical considerations, strategic implications, and the persistent uncertainty around a threat actor’s intent. It is rarely a straightforward calculation, and caution remains a consistent theme.

🤝 Inclusive decision-making

In high-pressure crisis rooms, it is natural for some voices to hesitate.

Yet those perspectives may hold insights that meaningfully influence the trajectory of an incident. Supportive and psychologically safe environments are not merely cultural ideals, they are critical enablers of effective response. ✨

🎭 Diplomacy in response

Soft skills often sit quietly in the background of technical discussions, but during incident response, they become pivotal.

The “chameleon” metaphor resonated deeply: the ability to gauge the room and adapt one’s approach accordingly. Whether engaging MSSPs or internal stakeholders, diplomacy and emotional intelligence are powerful tools.

On a personal note, I was quietly flattered to be described as

“the woman who asks difficult questions.”

I am grateful for spaces that welcome curiosity and thoughtful challenge — that is where meaningful learning happens. 🤍

It was energising to reconnect with familiar faces, cross paths unexpectedly with colleagues, and engage with fellow WiCyS members about the many journeys that bring us into cybersecurity.

I left feeling thoughtful, energised, and reminded that the space between detection and decision is where leadership is truly tested. ✨