What to Do the Monday After a Competitor's Breach

Monday morning, the headline lands: a competitor has been breached. The board will ask about it by Friday. The honest answer is not "we are different." It is "here is what we checked."

A rival's breach is the cheapest lesson you will ever get. Someone else paid for it. The only waste is letting the week pass without converting it into evidence about your own position.

A five-day learning review does that conversion while the details are still fresh.

Key takeaways

• Same industry means same attacker interest; assume the campaign includes you.

• Check exposure first: do you run what they ran?

• Then check controls: would your defenses have caught it?

• Close with a short board note and a customer reassurance decision.

• Five days is enough for a first pass; depth can follow.

Step 1: Check exposure on Monday

Start with the mechanics reported so far. What was exploited - a vendor, a software flaw, stolen credentials, an unpatched system? Then ask the only question that matters today: do we run that too?

Your team should be able to answer from the asset inventory, not from memory. If answering takes a procurement archaeology project, that is a finding worth writing down.

Step 2: Check the controls on Tuesday and Wednesday

Exposure is not outcome. Walk the reported attack path against your own defenses. Where would your monitoring have fired? Where would it have stayed quiet? NIST's incident response guidance (SP 800-61 Rev. 3) builds continuous improvement into the response life cycle - learning from incidents, including other people's, is part of the job, not an extra.

Be honest about the answer "we would not have caught that either." It is the most valuable sentence the review can produce, because it comes with time to fix it.

Step 3: Decide the fixes on Thursday

Split the findings into what closes now and what queues. Every queued item gets a date. The five-day schedule below is illustrative; compress or stretch it to fit your team.

Day (illustrative)	Work	Output	Owner
Monday	Exposure check against reported cause	Yes/no list: do we run it, are we reachable the same way	Security lead
Tuesday-Wednesday	Control gap check along the attack path	List of detection and prevention gaps	Security lead + IT
Thursday	Decide fixes: what closes now, what queues	Prioritized action list with dates	Security lead
Friday	Board note and customer reassurance decision	One-page note; decision on proactive customer communication	Executive sponsor

Step 4: Write the board note on Friday

Directors do not want the technical detail. They want four lines: what happened to them, whether it can happen to us, what we are doing about it, and when we will report back. A page is enough, and it converts anxiety into oversight.

Step 5: Decide the customer question explicitly

Decide whether to reassure customers. Sometimes silence is right; sometimes a short note about your own checks protects the relationship. What you cannot do is let the decision happen by default. For the longer arc of breach response, see from breach to bounce back.

Frequently asked questions

What if details about the breach are still scarce?

Work with what is reported and mark assumptions. A review built on labeled assumptions beats no review; update it as facts emerge.

Should we do this for every industry breach?

No. Reserve the five-day review for breaches in your sector or against technology you depend on. Otherwise the exercise becomes noise.

Who should lead it?

The security lead runs the checks; an executive sponsor owns the board note and the customer decision. Without a sponsor, the findings stall.

What if we find we are exposed?

That is the review working. Fix what can be fixed now, queue the rest with dates, and say both plainly in the board note.

A Defensible Next Step

Pick the most recent breach in your sector and ask your team the day-one question: do we run what they ran? If the answer takes more than a day, start there. Book a Decision-Clarity Call if you would like help structuring the review.