What’s Empathy Got to Do with Cyber Incidents

Great decisions require confident collaborators, the right data, calm thinking, and empathy.

That's right, empathy.

Empathy is the ability to recognize, understand, and appreciate what others are experiencing, allowing teams to form a shared perspective when making decisions. But even under these ideal conditions, technology can introduce friction, causing decision quality to deteriorate rapidly.

So, what actually happens inside an organization when a cyber crisis begins? Do people feel confident and supported, operating from a shared perspective? Or are they confused and threatened, working in silos with fear-induced tunnel vision? Is the technology putting the team in the right thought space, or creating the kind of friction that inevitably reduces decision quality?

When you break the decision flow down to its atomic level, you begin to recognize the many decisions involved—and the competing objectives behind them.

Within minutes of a Sev-1 incident, the leadership team begins the decision process with demands:

• The CISO wants to contain. Fast.
• The COO wants to ensure continuity. Always.
• The CFO wants to protect revenue without introducing new costs.
• The board wants an update within 90 minutes.
• The CMO and CRO haven't even entered the room yet.

Same incident. Completely different demands.

Not exactly the kind of shared perspective that produces empathy.

One Incident, Many Decisions

Incident response decision-making is a network of decisions happening simultaneously. We are all familiar with them:

• Do we shut systems down?
• Are backups viable?
• What revenue is at risk?
• Do we pay the ransom?
• What regulatory notifications are required?
• What does cyber insurance actually cover?

These are not sequential questions. They are parallel decisions happening across the leadership team. And they often need to start resolving within the first 15 minutes after the incident is confirmed.

Why Decision-Making Breaks

This part is important. When these conversations start, the leadership team is not actually deciding together. Each executive is operating inside their own information environment.

• The CISO is inside security dashboards.
• The CFO is inside financial exposure models.
• Operations is looking at system uptime.
• Marketing is watching revenue systems.
• Legal is reviewing regulatory obligations.

Each role is working from a different mental model of the incident. So, something predictable happens. Context gets lost. Decisions get re-litigated. Attention fragments across tools.

It's Not the People

This is important.

This is not a people problem. The executives involved are usually experienced, capable leaders. The problem is architecture. Every executive is looking at a different screen.

Every screen resets context. Every system presents information in a different language.

So the leadership team ends up spending time translating between tools instead of making decisions. And what you see in almost every cyber war room is something surprisingly consistent: Everyone argues from inside their dashboard.

Which brings us back to the core idea. Decision quality is not random. It follows a structure. Decision quality = (right data × confident operators × an environment of empathy) ÷ friction.

Cyber incidents do not break organizations because the threat is sophisticated. They break organizations because the decision environment collapses under pressure. Great decisions require the right data, confident operators, and the ability to stay calm and empathetic. But those conditions only exist when the technology supporting the decision flow reduces friction instead of amplifying it.

Mesh Commons meets monthly with cybersecurity leaders to tackle this decision-making challenge. If you're interested attending, join us.