At a CISO Platform fireside chat, Sudhakar Ramakrishna, CEO of SolarWinds, looked back on one of the most scrutinized breach responses in recent memory. His reflection was not about detection or containment. It was about the part of the crisis most incident plans never budget for.
The volume of press noise was what they most underestimated. Ramakrishna said the technical response was demanding, but the level of noise and misinformation in the press was the dimension the team was least prepared for. In his words, "What we underestimated was the level of noise in the press."
The instinct was to spend on customers and employees first. During the crisis, the natural pull was to direct attention and resources toward the people most directly affected. That instinct is reasonable, but Ramakrishna now sees it as incomplete, because it left one channel underfunded.
With hindsight, he would fund crisis communications far more heavily. Ramakrishna was direct about what he would change: "If I were to rewind the clock, we should have put a lot more PR firepower at it." The gap was not strategy or technology. It was the resourcing of the public narrative while the technical work was still underway.
Why this matters for CISOs
Most incident response plans account for detection, containment, forensics, and legal review. Far fewer specify how much of the breach budget goes to crisis communications, or who owns the public narrative in the first 72 hours. Ramakrishna's account puts that decision on the table before an incident, not in the middle of one.
One question for the community
If you had to split a breach response budget today, what share would you commit to crisis communications versus technical remediation, and who in your organization owns that call?
Join the conversation
CISO Platform is a peer community where security leaders compare what these decisions actually cost. Join the community and add your own experience.
Source: This clip is from a CISO Platform fireside chat with Sudhakar Ramakrishna, hosted by Bikash Barai. Watch the full talk.
Comments