How to Calm Executives During Ransomware Crises

TL;DR

Calm a panicked executive team by recognizing its stress stage, addressing immediate needs, and communicating in ways that a stressed brain can process. Preparation also matters: handwritten worry lists can reduce rumination, while short, unstructured brain breaks may help responders stay fresh and productive during demanding cybersecurity work.

Transcript

Good morning, everybody. Uh, I'm Ed Vasco. I'm the director of the Institute for Pervasive Cybersecurity at Boise State University, and my co-panelist. Go ahead. I'm Carol Barks. I am also a professor at Boise State University. I also am a, a neuroscience-based conflict and communication specialist, uh, featuring, uh, mediation and how do we talk t... Read More

Key Insights

• Executive stress develops through recognizable stages: confirmation and panic, overreaction and anger, and a kitchen-sink moment in which leaders want every available response applied to the crisis.
• An untested acquisition can create serious exposure: the hypothetical fintech company purchases a progressive business and its platform without conducting testing, assurance, or adequate validation before integration.
• A ransomware incident can escalate across several fronts at once: the scenario includes data exfiltration, dark-web uploading, media awareness, outreach to executives, and urgent internal calls from the security operations team.
• The CRAP board is a handwritten inventory of conflicts, resistances, anxieties, and problems or procrastinations that are occupying attention, causing worry, or interfering with sleep.
• Handwriting concerns can reduce mental repetition: once worries are recorded externally, the brain no longer has to keep rehearsing them solely to avoid forgetting them.
• Reviewing written worries helps separate current concerns from old stories: trusted colleagues or family members can also identify additional stressors that the person may not have recognized independently.
• Short brain breaks support sustained work: the recommended practice is to stop for two to five minutes every hour, leave the room when possible, go outside, or walk to increase oxygen flow.
• Unstructured time gives unconscious processing room to operate: the presentation says current scientific discussion attributes 98 to 99 percent of thoughts to processes occurring outside conscious awareness.

Questions & Answers

Q: How should a CISO communicate with panicked executives during ransomware?

A CISO should first recognize which stress stage executives are displaying: confirmation and panic, overreaction and anger, or the kitchen-sink impulse to apply every possible solution. Communication should address their immediate needs in a way that stressed brains can hear, while helping prioritize actions and preserve organizational calm. Interpreting the reaction as a natural stress response can make the conversation more manageable.

Q: What are the three stages of C-suite stress during ransomware?

The three stages presented are confirmation and panic, overreaction and anger, and the kitchen-sink moment. The first begins when executives realize that something serious is happening. The second produces heightened reactions and anger. In the final stage, leaders may want to throw every available measure into the response, reflecting the kitchen-sink idiom described by the presenters.

Q: Why is acquisition security validation important before integration?

The hypothetical scenario shows that skipping validation can leave an acquiring company exposed to risks within a newly purchased platform. OldCo acquires NewbCo without testing the platform or obtaining assurance about it. When the ransomware crisis appears, the missing merger and acquisition process and absent platform validation become central concerns, increasing pressure on the CISO and the executive team.

Q: What makes the ransomware scenario especially stressful for the CISO?

Several problems occur simultaneously in the scenario. The security operations team calls at 4 PM on a Friday after receiving the feared ransomware email. Data has been exfiltrated and is being uploaded to the dark web, a journalist has been alerted, outside parties are contacting the company, and anxious executives begin calling the CISO while the organization faces public exposure.

Q: What is a CRAP board and how does it reduce worry?

A CRAP board is a handwritten list of conflicts, resistances, anxieties, and problems or procrastinations. It functions somewhat like a to-do list for worries. Recording concerns means the brain does not have to keep repeating them simply to remember them. Reviewing the list also allows a person to consider which concerns are real and which may come from older stories.

Q: Why should a CRAP board be handwritten instead of typed?

The presenter specifically recommends writing a CRAP board on paper rather than typing it on a laptop, computer, or phone. Her explanation is that handwriting uses different neural networks. Once worries are physically recorded, the brain can detach from some of them because it knows they have been preserved, allowing those concerns to lose some of their power over attention.

Q: How can short brain breaks improve performance during stressful work?

The recommended approach is to take an unstructured break for two to five minutes every hour instead of powering continuously through the day. Standing up, leaving the room, going outside, or walking can refresh attention and create space for mental processing. The presenter says these pauses can help people accomplish more and remain productive because the brain continues significant work outside conscious awareness.

Q: Why does changing rooms help during a brain break?

Leaving the room introduces a different environment that engages the brain in noticing where the person is going and whether the new space contains threats. The presenter describes this environmental shift as activating a different neural network. Going outside is presented as even better when possible, while walking also helps by getting oxygen to the brain during the short pause.

Summary & Key Takeaways

• A hypothetical fintech ransomware crisis illustrates the pressure facing a CISO when an acquired platform was never tested or independently assured. At 4 PM on a Friday, the security operations team reports exfiltrated data, dark-web exposure, media attention, and escalating calls from executives who suddenly recognize the seriousness of the incident.

• The presenters organize executive stress into three stages: confirmation and panic, overreaction and anger, and the kitchen-sink moment when leaders want to apply every possible solution. Understanding these reactions helps cybersecurity professionals interpret executive behavior, prioritize communication needs, and maintain greater organizational calm while a ransomware response is unfolding under severe pressure.

• A handwritten CRAP board records conflicts, resistances, anxieties, and problems or procrastinations, allowing the brain to stop repeatedly holding them in memory. Short brain breaks of two to five minutes every hour, preferably involving movement or a change of environment, can also provide unstructured time for unconscious mental processing and renewed productivity.