What it leaves behind

An exercise that produces only a feeling has produced nothing. What makes the loop worth running is what stays after: a shared account of what happened, a short list of what to change, and the artefacts that carry the change into the ordinary day.

The reflection is where it starts, and it is the easiest thing to skip under time pressure. A timeline of what happened when, what fired, what was missed, so the conversation rests on the record rather than on whatever was memorable. A gap named specifically enough that the next conversation can be about the fix rather than about whether the gap is real. A reading of what produced it, since a tooling limit, a broken process, a training gap, and a missing decision-right each need a different repair, and treating one as another closes nothing. And a short priority, because a list with everything on it has nothing on it.

The exchange runs both ways. One direction is obvious, attacker to defender: every command, path, and connection handed over, so a rule can be built from the technique just seen and a procedure updated for the pattern it missed. The quieter direction runs back: a defender who knows where the visibility is thin, or where a new tool has just landed, can ask for that path to be tested next, which surfaces the wins worth defending rather than the gaps already known. None of it works without a blameless reading and enough safety to describe what was actually seen and done, stated in a sentence and built over years and lost faster than built.

Two kinds of document come out of it, and they are often confused. A playbook handles a class of situations that can unfold more than one way: it carries decision points and branches, and is used as a guide, not a script. A runbook carries a single procedure that runs the same every time, linear and prescriptive, where consistency is the whole point and improvisation is the failure. A playbook the people who will run it built together tends to get followed; one written by a single hand and filed tends not to.

The cases rhyme. A ransomware run where the credential-dumping was caught and contained fast, and the gap nobody had planned for was the backup restore, never tested at the scale a real incident would need. An insider run where the behavioural analytics worked but arrived hours in, while the early collection passed as ordinary access. In both, the loud part went roughly as hoped. The quiet gap was elsewhere: the untested recovery, the slow baseline.

Last updated: 3 July 2026