10 Reasons Your Incident Response Plan Isn't Working (And How to Fix It Before a Breach)

Most UK business leaders operate under a dangerous illusion: the belief that having a "security team" or an "IT guy" is the same as having a plan.

It is not.

According to the Cyber Security Breaches Survey 2025/2026, only 25% of UK businesses have a formal incident response plan in place. For SMEs, the reality is even more stark: 43% have no plan at all. They are effectively driving at high speed in the dark, without headlights, hoping the road remains straight.

The road is not straight.

Ransomware can now encrypt your entire infrastructure in under two hours if you are unprepared. Meanwhile, the average time to identify a breach remains at an staggering 200+ days. This gap between infection and detection is where businesses die.

If you are a CEO or board member at a scale-up, you cannot afford to treat incident response as a "technical problem." It is a material risk to your business continuity.

Here are ten reasons your current incident response plan: if you even have one: is failing, and exactly how to fix it before the next breach occurs.

1. The Strategy of "Hope": No Formal Plan

Many SMBs rely on "improv." They assume that because they have talented IT staff, those staff will know what to do when the screens go black.

This is a governance gap. Technical skill is useless without a pre-defined sequence of operations. When a crisis hits, adrenaline spikes, and logic fails. Without a script, your team will waste the most critical first 60 minutes arguing over priorities.

The Fix: You must document a formal Incident Response Plan (IRP). This isn't a 100-page manual; it’s a high-level strategic framework that dictates how your business will react, communicate, and recover.

2. The Paperweight Problem: Never Tested

A plan that exists only on a PDF in a folder is not a plan; it’s a liability.

If your team hasn’t walked through a scenario in the last six months, they won’t execute it correctly under pressure. Most "plans" fail during the first real-world stress test because they were designed in a vacuum.

The Fix: Conduct quarterly tabletop exercises. These are facilitated sessions where leadership and technical teams walk through a realistic scenario: like a ransomware attack or a senior executive’s email being compromised. It exposes the gaps in your thinking before a hacker does.

3. Missing the Conductor: Unclear Roles and Ownership

Who is in charge? In many organizations, the answer is "the IT Manager."

This is a mistake. An incident requires more than technical remediation; it requires legal, PR, HR, and board-level decision-making. If your technical team is also trying to manage communication with the board, they aren't fixing the problem.

The Fix: Appoint a dedicated Incident Manager. This individual doesn't need to be the most technical person in the room; they need to be the best coordinator. Their job is to manage the timeline, delegate tasks, and ensure the business continues to function while the technical team works in the background.

4. The Digital Lockout: Outdated Contact Lists

When your network is encrypted, where is your plan?

If your incident response plan and contact lists are stored on your internal SharePoint or server, and that server is currently being held for ransom, you have nothing. Furthermore, if your contact list hasn't been updated in a year, you’ll be calling people who no longer work for the company.

The Fix: Maintain offline access to your IRP. Use a secure, third-party cloud vault or encrypted physical copies. Ensure contact details for key stakeholders: including legal counsel, cyber insurance, and your fractional CISO: are updated monthly.

5. Insurance Is Not a Plan

There is a pervasive myth that cyber insurance is a substitute for operational readiness.

Insurance might cover the financial loss, but it won't restore your reputation or bring back the clients who left because you were offline for three weeks. Relying solely on insurance is a reactive strategy that ignores the reality of business resilience.

The Fix: Treat insurance as a secondary safety net. Your primary focus must be operational readiness. This means having the incident response planning and infrastructure in place to contain a threat before it becomes a catastrophic claim.

6. The Decision Vacuum: Missing 24/7 Escalation

Cybercriminals don't strike at 10:00 AM on a Tuesday. They strike at 2:00 AM on a Bank Holiday.

If your team identifies a breach on a Saturday night but doesn't have the authority to shut down a critical server without "approval," the damage will multiply exponentially before Monday morning.

The Fix: Establish clear delegated authority. Your security team or external partners must have the pre-approved authority to take drastic containment actions (like isolating segments of the network) without waiting for a board meeting.

7. Alert Fatigue: Detection Without Action

Most businesses have plenty of tools. They have firewalls, EDR, and log management.

The problem is that these tools generate thousands of alerts every day. When everything is a priority, nothing is. If your team is drowning in "noise," they will miss the one signal that indicates a live intruder.

The Fix: Shift from "collecting data" to "actionable intelligence." Streamline your security stack and ensure that alerts are tuned to trigger specific incident response actions. If an alert doesn't have a corresponding playbook, it’s just noise.

8. The GDPR Clock: ICO Notification Delays

Under GDPR, you have 72 hours to report a data breach to the ICO if it poses a risk to individuals.

If you spend the first 48 hours wondering if you’ve actually been breached, you are already out of time. Notification delays lead to heavier fines and increased regulatory scrutiny.

The Fix: Integrate regulatory requirements directly into your response playbooks. Your IRP must include a "Data Privacy" branch that triggers an immediate legal and compliance review the moment personal data is potentially impacted.

9. Burning the Crime Scene: No Forensic Preservation

In the rush to "get back online," many technical teams inadvertently destroy the evidence.

They wipe servers, restore backups, and overwrite logs. This makes it impossible to determine how the attacker got in, what they took, or if they are still there. It also makes it nearly impossible to successfully file an insurance claim.

The Fix: Standardize a forensic evidence preservation plan. Your first step should be containment, not deletion. Ensure your team knows how to take memory dumps and disk images before they start the recovery process.

10. The Groundhog Day Loop: No Post-Incident Review

If you don't learn from an incident, you are guaranteed to repeat it.

Most SMBs are so relieved when the crisis is over that they immediately return to "business as usual." They never analyze why the plan failed or how the attacker bypassed their defenses.

The Fix: Mandate a Post-Incident Review (PIR). This is a non-blame session to dissect the timeline, identify failures in the plan, and update your security posture. This is the final pillar of security maturity.

The Governance Gap: Why Technical Fixes Aren't Enough

The common thread in all ten failures is a lack of strategic leadership.

UK SMBs often have technical staff who can configure a firewall, but they lack the executive-level oversight to manage cyber risk as a business function. They are reactive when they need to be proactive.

At Torridon Cyber, we bridge this gap.

Our fractional CISO services provide SMBs and scale-ups with the elite security leadership they need: without the overhead of a full-time executive. We don't just tell you that you need a plan; we design, implement, and manage your strategic security roadmap using our proven four-pillar methodology.

Closing Perspective

An incident response plan is not a "nice-to-have" for a modern business. It is a fundamental requirement for survival in a landscape where breaches are a matter of "when," not "if."

If your current plan: or lack thereof: is keeping you up at night, it’s time for a different approach. You don't need more tools; you need better governance. You need a partner who understands that cybersecurity is about protecting your ability to do business, not just your data.

Is your business ready for the next two hours?

Request a confidential consultation with a Torridon Cyber expert today. Let’s move your security from reactive to resilient.