04. Crisis Management Gone Wrong by Maciej Jan Broniarz

Incident response themes

Security consultant Michal Bronisz at x33fcon presents anti-patterns in crisis management drawn from real client work, warning that audits and IR engagements often surface deliberate omissions that delay root-cause analysis for days.

Organizational denial

He compares ignored known risks to the Challenger disaster metaphor: teams see exploitable weaknesses outside their silo and assume someone else owns them. IT security teams frequently tell consultants leadership already ignored identical warnings until external consultants repeat them.

Concrete failures

Examples include U2F keys left on desks because replacements were expensive, CEOs angrily complying with weekend phishing tests, firewalls logging massive Tor activity before ransomware, ISO 27001 remote audits delivered with answer keys, alert floods filtered into oblivion, and checkbox security matrices where only the responsible engineer remains unchecked.

Fix the basics

Bronisz argues companies over-focus on mapping entire security domains while attackers exploit the simplest path. He recommends tuning noisy tools, assigning real ownership outside IT-only models, and fixing one issue at a time for meaningful gains rather than paper compliance.