What Directors Should Ask After a Near Miss

A harmful action was stopped before it reached its intended target. That is good news. It is not enough information to conclude that the business's controls are working as intended.

The board should ask what caught the event, what allowed it to get that far and whether the outcome depended on a repeatable control or a fortunate interruption. Keep the discussion focused on learning and ownership, not an imagined catastrophe presented as a measured loss.

These cyber near-miss board questions turn a reassuring headline into a practical decision about the next exposure.

Key takeaways

• Separate the observed event from the harm that might have occurred.

• Identify the control that worked and the conditions that made it effective.

• Examine the earlier gap without blaming the person who reported it.

• Assign changes and test their effect rather than closing a presentation.

• Review whether the same conditions exist elsewhere.

Step 1: Establish the facts and the boundary

Describe what happened, how it was detected and what was prevented. State what investigators know and what remains uncertain. A blocked payment request is not evidence that money was lost. A stopped access attempt is not automatically proof that no other access occurred.

Define why management calls the event a near miss. The term should support analysis, not become a way to avoid incident handling or notification assessment where the facts require them.

NIST SP 800-61 Revision 3 integrates response and learning into wider risk management. It also supports sharing lessons as they are identified instead of waiting for every recovery activity to end.

Step 2: Test the success story

Ask which control interrupted the event and whether it was designed to do so. Was an employee following a supported verification process, or did someone notice an unusual detail by chance? Both can help. They offer different confidence about the next event.

Check coverage. A control may work in one office, payment channel or product while similar workflows remain outside it. Avoid converting one successful outcome into a company-wide claim.

Step 3: Use a near-miss review record

This fictional example concerns a fraudulent payment request stopped by independent verification. It is not an actual company incident or an estimate of avoided loss.

Review field	Fictional observation	Follow-up decision
Detection path	An employee used the established callback route.	Confirm the route is current and available to other teams.
Gap that allowed progress	A changed payment request entered the normal queue.	Review the intake and approval controls.
Boundary of evidence	The payment did not execute in this observed workflow.	Check for related requests without assuming broader safety.
Accountable action	Finance owns the workflow change; security supports testing.	Set a date and a representative test of the revised process.

Preserve relevant evidence under the company's access and retention arrangements. Keep sensitive details out of a broadly distributed summary where they are not needed for the decision.

Step 4: Examine conditions without punishing reporting

Ask whether workload, unclear authority or conflicting incentives made the risky path easier. Recognize the reporting behavior that made the review possible. A process that punishes people for bringing forward mistakes can reduce the evidence leaders receive.

The deepfake fraud controls discussion addresses why convincing identity cues should not replace independent verification. After a near miss, test the workflow rather than simply asking people to be more suspicious.

Step 5: Close through evidence and broader checks

Assign each action an owner, due date and success condition. Check whether a similar gap exists in other important workflows. The answer may be a targeted fix, a wider change or an explicit decision to retain a bounded exposure.

Report what changed and what the test demonstrated. Do not claim the business is now immune to the attack. A useful review improves the next decision while keeping the limits visible.

Sources

NIST, SP 800-61 Revision 3, April 2025, incident response and continuous improvement. The near-miss record and fictional payment example are editorial recommendations.

Frequently asked questions

Should every near miss reach directors immediately?

No universal rule fits every organization. Use agreed escalation criteria based on potential consequence, control failure, recurrence and the decisions directors need to make.

Can management estimate the loss avoided?

It can analyze a clearly labeled scenario where evidence supports the assumptions. It should not present a hypothetical amount as an observed saving.

Is the person who caught the event the action owner?

Not necessarily. The owner should have authority to change the relevant process. The reporter can provide evidence without being responsible for fixing the entire system.

When is the review complete?

When the facts, remaining uncertainty, decisions and assigned actions are recorded, and the appropriate follow-through is arranged. Action closure still requires evidence of effect.

Closing

Ask what would make the same event end differently next time. Then give the answer an owner and a test. A near miss is useful when it changes the operating conditions, not just the tone of the next briefing.