2025 - Lauren Proehl - Lessons Learned from the Fires of Response

Lauren Proehl, Global Head of Detection Response at Marsh McClennon, distills 11 years of blue team experience into lessons spanning process, people, and technology. She argues that incident response success depends equally on human factors and technical controls.

**AI as Double-Edged Sword**: Proehl demonstrates using free ChatGPT to analyze indicators from DFIR reports, showing how AI can help junior analysts identify malicious behaviors and suggest investigation steps. However, she emphasizes that threat actors actively exploit AI—using MCP servers as command-and-control infrastructure, leveraging AI to automate reconnaissance, and reducing the knowledge barrier for attacks. Anthropic's threat reports document real examples of threat actors querying Claude for Outlook exploitation and host enumeration.

**Documentation and Decision Trees**: The first five minutes of incident response matter as much as the next five days, but this requires disciplined documentation. Every action must have timestamps; analysts must be able to replicate prior work from ticket notes alone. Proehl advocates explicit decision trees that translate gut feelings into documented logic—e.g., after-hours alerts raise maliciousness scores, targeting NTDS is suspicious—enabling junior analysts to learn expert intuition.

**Relationships and Collaboration**: Security professionals must build relationships across organizations (legal, executives, finance, help desk) before crises occur. Proehl credits lawyers as essential partners, especially given the expanding regulatory landscape. She stresses: "We can only do this one way and it's together."

**Regulatory Complexity**: Data protection and cybersecurity regulations have expanded exponentially since 2016, now spanning North America (state-by-state), APAC, AMER, and AI governance. These regulations often conflict with incident containment timelines. Proehl warns that regulators may scare her more than adversaries and advocates legal involvement in incident planning.

**CTI is Non-Negotiable**: Threat actors exploit vulnerabilities before public disclosure (Google threat intelligence shows negative-day exploits). Without threat intelligence, organizations cannot compete. While dedicated CTI services are expensive, options include MDR providers, managed intelligence shops, and community sources. CTI enables blocking low-hanging-fruit IOCs (commercial VPNs, ASN blocks) and slowing attackers.

**Adversary Velocity**: The time from initial access to lateral movement averages 48 minutes but can be as short as 51 seconds. CVE publication rates are at record levels, and not all become KEV-labeled patches. This acceleration makes intelligence-driven defense essential and prioritization critical.

**Burnout and Resilience**: Proehl shares her personal experience: at 26, working 70–80-hour weeks on high-profile ransomware cases led to illness and a brain tumor diagnosis. She emphasizes burnout is inevitable and advocates proactive prevention: regular breaks, recognition programs, investment in development, and culture that acknowledges "it sucks" without gaslighting. Seventy-six percent of security professionals have experienced or are experiencing burnout.

**Business Translation**: Executives care about money. Proehl describes building a threat hunting program by presenting quantitative business risk reduction. Key metrics include mean-time-to-detect (MTTD), heat maps of alert distribution, ICE metric (incidents caught at execution vs. later stages), rate of repeat incidents, and cost per incident. Avoid measuring individual analysts by raw ticket count; she cites an analyst who closed 5,000 phishing-test tickets but had never handled a novel incident.

**Technical Challenges**: Microsoft Teams exposed externally enables Scattered Spider social engineering. Commercial VPN authentication allows DPRK impersonation. Unsecured cloud control planes (F5 breach: 45+ stolen zero-days) are critical risks. Unpatched legacy vulnerabilities, weak password policies, weak insider threat monitoring, and lack of open-source supply chain visibility compound risk. Proehl recommends patching external-facing RCE vulnerabilities first, securing control planes via services, and implementing trusted repositories for dependencies.