Decision Latency in Cybersecurity Incident Response

In large organizations, the speed of incident response is constrained by the delay between incident detection and responsive decision making and subsequent action. This decision latency is due to, for example, organizational structure, risk governance and accountability distributions. Most of these are optimized for authority but not for speed. As cybersecurity incidents can evolve very quickly, the solution space of possible responsive actions can diminish quickly, and decision latency should be minimized. In this paper we explore some trade-offs that can be made to reduce decision latency during cybersecurity incident response.