Next up in this eye-opening series from Sam Lambert, EMEA Channel Director at Gigamon, is his core insights on handling a crisis – the first step? Understand what is actually happening…
In a crisis, the first question is rarely “Which alert should we investigate?” It is more likely to be: “What is happening, what does it affect and what should we do next?”
That distinction matters. Security teams may have thousands of alerts, while operational leaders need a small number of decisions. A port operator needs to know whether cargo movement is safe. A defence organisation needs to know whether a mission is compromised. A government needs to know whether an incident is isolated, spreading or part of a coordinated campaign.
The challenge is that cyber-physical incidents cross traditional boundaries. A network event may affect a physical process. A physical intrusion may enable a cyber compromise. A failure in a third-party service may look like an internal systems problem. A disinformation campaign may amplify the impact of a technical outage by creating confusion about what is true.
The answer is not simply more dashboards or more data. It is a shared operational picture built around independent evidence, trusted context and a clear path to decision. That evidence should be usable by people, existing tools and increasingly AI systems supporting operational decisions.
A useful picture should connect:
• Assets to services and missions
• Users and identities to the systems they can reach
• Communications to expected behaviour and business purpose
• Technical events to physical and operational consequences
• Local incidents to wider dependencies and geography
• Detection to ownership, authority and response action
This is particularly important in government and defence, where different organisations may hold different parts of the truth. One agency may see the network activity. Another may understand the physical site. A supplier may know the maintenance pattern. A military or civil authority may understand the mission consequence. Without a mechanism to combine those views, each organisation may make a reasonable decision using an incomplete picture.
The European framework is moving towards this broader concept of resilience. The Critical Entities Resilience Directive defines resilience as the ability to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from an incident. It also requires attention to cross-border and cross-sector dependencies.
For leaders, the practical test is speed and relevance:
• Can we establish a trusted baseline of normal behaviour?
• Can we identify the assets and services that matter most?
• Can we share a usable picture with the right authority without creating unnecessary exposure?
• Can we move from technical evidence to an operational decision?
A mature approach does not attempt to eliminate uncertainty. It reduces uncertainty quickly enough for people to act.
Situational awareness is not the final layer of a security architecture. It is the foundation for proportionate action. In a hybrid crisis, the speed at which leaders establish what is happening may determine whether disruption remains local or becomes strategic.
At Vizst Technology, we are proud to be Gigamon’s EMEA Partner of the Year, so if you’re looking to discuss your thoughts on the above, give our expert team a call on 03333 442204.