Survive Your Security Incident ...and Thrive Again

Survive Your Security Incident ...and Thrive Again

Speakers: Coleen Coolidge, CISO, Segment

Conference: LocoMocoSec

YouTube: https://www.youtube.com/watch?v=Lq6FXAcYDTU

Overview

In "Survive Your Security Incident ...and Thrive Again," Coleen Coolidge, CISO at Segment, delivers a compelling and deeply human perspective on navigating the aftermath of a public security incident. Moving beyond the typical technical checklists, Coolidge's talk delves into the often-overlooked emotional and psychological toll such events take on security teams, advocating for a holistic approach to incident response that prioritizes mental wellness alongside technical remediation. This article explores her framework for not just surviving, but truly thriving, by addressing team well-being, strategic communication, and fostering a supportive security community.

Coolidge frames the experience of a security incident as akin to the disorienting challenges of 2020 itself, highlighting the acute stress, anxiety, and burnout that can plague security professionals. She shares personal anecdotes and practical strategies, emphasizing that effective long-term security posture hinges on the resilience and psychological health of the individuals on the front lines. The talk is a powerful call to normalize discussions around mental health in the security industry, providing actionable advice for leaders and practitioners alike to build stronger, more sustainable security programs.

This insightful presentation is crucial for any security leader or team member who has experienced the unique pressures of a breach or who wishes to prepare for one more effectively. Coolidge's emphasis on turning trauma into strategic advantage, fostering open communication with executive leadership and the board, and strengthening the broader security community offers a refreshing and vital counter-narrative to traditional incident response methodologies, ultimately aiming for a more empathetic and effective security ecosystem.

Background

▶ Watch: Introduction and talk overview (0:00)

The security industry operates under immense pressure, with professionals constantly battling an evolving threat landscape. While technical expertise in incident response (IR), vulnerability management, and security architecture is paramount, the human element—specifically, the mental and emotional well-being of security teams—is frequently sidelined. Coleen Coolidge highlights this critical gap, noting that while standard operating procedures for incident resolution are well-established, the "emotional and energy drain" on individuals is rarely addressed with the same rigor. This oversight contributes to high rates of burnout, anxiety, and depression within the field.

Coolidge recounts a pervasive "leftover trauma" among security professionals, often manifesting as a superstitious dread around holidays and vacations, times when incidents notoriously occur. This fear is not unfounded; her team experienced a significant account takeover incident over Labor Day weekend in 2019. This event, though relatively contained (involving business contact and usage data, but no end-user information), served as a stark reminder that even a "tame" incident can profoundly impact a team's morale and sense of self-worth. The incident prompted a deeper reflection on how to move beyond merely reacting to threats and instead foster a culture of resilience and proactive "fight back" strategies.

The underlying problem, as Coolidge articulates, is that security professionals are often left to grapple with feelings of failure, isolation, and an overwhelming sense of responsibility. This self-blame, combined with the constant vigilance required by the job, creates a cycle of fear that can hinder effective decision-making and prevent teams from capitalizing on incident learnings. Her talk serves as a much-needed intervention, urging the industry to acknowledge these silent struggles and integrate mental health support as a fundamental component of a robust security program, rather than an afterthought.

Key Findings

▶ Watch: Recognizing the emotional and mental dangers of incidents (8:08)

Coolidge's talk presents several key findings that challenge conventional wisdom in security incident management and team leadership:

1. Mental Health is a Core Security Challenge: Security incidents, especially public ones, inflict significant psychological damage, leading to anxiety, depression, sleep deprivation, and self-doubt among team members. Addressing this incident trauma through structured mental wellness programs (like the Ginger app or positive evidence diaries) is not optional but essential for team recovery and sustained effectiveness.
2. Strategic Communication Drives Remediation: Technical vulnerabilities often fail to gain traction with product teams or executives. Translating these into vivid "scary stories" that articulate business impact (e.g., PR headlines, revenue loss, specific adversary personas like "Fishing Fred") is far more effective. Linking these narratives directly to Jira tickets or similar remediation tasks ensures accountability and prioritization.
3. Transparent Metrics Empower Leadership: Simply tracking vulnerabilities is insufficient. Executive teams and boards need clear, concise metrics that highlight late vulnerabilities by department and group. This transparency allows leadership to identify struggling areas, allocate resources, and make informed decisions regarding product quality and security investment, avoiding "Soviet-era redaction" of critical information.
4. Community Support is a Collective Defense: The security community often operates in silos, repeating the same mistakes. Fostering an empathetic, trust-based environment for sharing incident learnings (e.g., through Chatham House rules discussions) can dramatically improve collective security posture. Acts of kindness, like sending "incident cupcakes," reinforce solidarity and combat isolation.
5. Empowered Teams are Resilient Teams: Security professionals thrive in environments where their work is believed, respected, and empowered. Companies that invest heavily in security, listen to their teams, and allow open communication are more likely to retain talent and build robust defenses. Conversely, a lack of support is a clear signal for talented individuals to seek better opportunities.

These findings collectively advocate for a paradigm shift in how security incidents are perceived and managed, moving beyond purely technical responses to embrace a more human-centric, strategic, and collaborative approach.

Technical Deep Dive

▶ Watch: Engaging product teams with scary security stories (21:00)

The technical core of Coolidge's discussion revolves around an account takeover (ATO) incident that occurred over Labor Day weekend in 2019. An unauthorized user gained access to an engineer's account, allowing them to browse and view business contact information and business usage data. Critically, the attacker did not access customer and end-user information, a small but significant win that tempered the overall impact. This incident underscored the constant race against time, as the team had "solid plans to execute on further lockdown steps" that were unfortunately preempted by the breach.

Post-incident, the immediate technical focus shifted to remediation and communication. The team drafted an incident bulletin, a delicate art requiring cross-functional input from security, legal, PR, customer success, engineering, and executive leadership. The bulletin emphasized what data was involved, what was not involved, and a concise list of immediate and near-term steps to prevent recurrence. This strategic communication avoided making "empty promises" about distant future improvements, focusing instead on concrete, accountable actions.

To prevent future incidents and proactively address weaknesses, Coolidge's team implemented several "fight back" tactics:

1. Scary Stories for Product Teams: Recognizing that product managers prioritize customer stories, the security team began translating technical vulnerabilities into compelling narratives of business risk. These "scary stories" detail potential negative outcomes, such as "the PR headline that comes out about our company," "how much business is lost in terms of ARR," and which companies might cease doing business. These stories often include detailed adversary personas, like "Fishing Fred," who is motivated and has specific methods. Each story is meticulously linked to Jira tickets or similar remediation tasks, ensuring that engineering work is contextualized within a broader business risk framework, making it harder for product teams to deprioritize. This approach ensures that security asks are framed in terms that resonate with product and business goals, rather than purely technical jargon.

1. Transparent Vulnerability Management Metrics: Moving beyond simple vulnerability counts, the team developed a system to track and report on late vulnerabilities. This wasn't about shaming, but about transparency. A weekly email, featuring a "colorful screenshot" of a spreadsheet, was sent to the CEO and the entire executive team. This report highlighted which departments or groups were struggling to meet their Service Level Agreements (SLAs) for vulnerability remediation (e.g., P1s within one day, P2s within a week). This system allowed executives to identify systemic issues, such as understaffed departments or a lack of focus on product quality, enabling informed decision-making on resource allocation and process improvements. The CEO, Peter, was so impressed that he requested the same tracking mechanism for vulnerabilities across all departments, including HR and finance, demonstrating the power of clear, impactful metrics.

1. Direct Board Communication: The security organization actively sought an annual (or at least quarterly) audience with the company's board of directors. The goal was to provide a plain-language assessment of the company's security weaknesses, avoiding "Soviet-era redaction techniques." This direct line to the board serves as a crucial check and balance, especially in organizations where security messaging might be "squelched" or overly politicized. The board, as experienced decision-makers, can provide support and guidance, ensuring that security concerns are elevated to the highest levels of governance.

These technical and process-oriented strategies demonstrate a mature approach to security, integrating risk communication and accountability beyond the security team itself, making security a shared responsibility across the entire organization.

Demo / Proof of Concept

▶ Watch: Weekly vulnerability reporting to execs and board (24:50)

While the talk did not feature a traditional technical exploit or live hacking demonstration, Coleen Coolidge provided a compelling "proof of concept" for mental health support within the security industry. She openly shared her personal experience using the Ginger mental wellness app provided by her employer, Segment.

Coolidge walked the audience through the app's interface, showing how she completed a quick, 16-question check-in in late October. She displayed screenshots of her responses to questions pertaining to interest levels, feelings of being down, appetite issues, feelings of failure, out-of-control worrying, and restlessness. She then revealed the immediate results page, which provided insights into her anxiety (difficulty relaxing) and feelings of failure. Crucially, the app didn't just diagnose; it prescribed a coping mechanism: keeping a positive evidence diary. This demonstration underscored the ease of access and tangible benefits of integrating mental wellness tools, making a strong case for employers to provide similar resources to their security teams. This personal and transparent sharing served as a powerful testament to the importance and practicality of mental health initiatives in a high-stress field.

Defensive Implications

▶ Watch: Q&A: Leader's role in rebuilding team morale (38:00)

The insights shared by Coleen Coolidge offer crucial defensive implications for security practitioners, leaders, and organizations aiming to build more resilient and effective security programs:

1. Prioritize and Formalize Mental Health Support: Organizations must acknowledge the severe emotional toll of security incidents and the inherent stress of the profession. This means integrating mental wellness programs, such as access to apps like Ginger, encouraging regular breaks, and fostering a culture where discussing mental health is normalized and destigmatized. Leaders should actively promote self-care and ensure resources are available for anxiety, guilt, and burnout. Post-incident, specific morale-boosting activities (e.g., team offsites, personalized rewards) should be budgeted and implemented based on team preferences.

1. Master Strategic Risk Communication: Defenders need to move beyond technical jargon when communicating with non-security stakeholders. Develop "scary stories" that vividly illustrate the business impact of vulnerabilities, using metrics like potential revenue loss, brand damage, and specific adversary motivations. Link these narratives directly to remediation tickets (e.g., in Jira) to provide context and urgency for product and engineering teams, ensuring security work is prioritized as product quality.

1. Implement Transparent Vulnerability Management: Establish clear Service Level Agreements (SLAs) for vulnerability remediation across all departments. Crucially, track and report on late vulnerabilities by group or department, rather than just raw counts. Deliver these metrics in a concise, transparent, and regular format (e.g., weekly emails) to the CEO and executive team. This approach drives accountability, highlights systemic issues, and empowers leadership to make informed decisions about resource allocation and process improvements. Extend this tracking to all departments, including HR and finance, to embed security responsibility company-wide.

1. Empower Security Teams and Foster a Blameless Culture: Security teams must be empowered to do their job, with their expertise respected and their concerns heard. Leaders should advocate for their teams, ensuring adequate resources and a direct line of communication to executive leadership and the board. Internally, cultivate a blameless culture that focuses on learning from incidents rather than punitive actions. Externally, regulatory bodies and legal departments should reconsider overly punitive contract terms that disincentivize open sharing and learning across the industry.

1. Engage and Support the Security Community: Actively participate in community discussions, especially those under Chatham House rules, to share learnings responsibly without attributing details to specific companies or individuals. Offer empathy and practical support to peers undergoing incidents, understanding that collective knowledge improves overall security posture. For individuals, leverage the InfoSec community on Twitter or online meetups for advice, encouragement, and networking, recognizing that a strong community provides options and support.

1. Know When to Seek a Better Environment: Security professionals are in high demand and have many options. If a company consistently fails to support its security team, disregards their advice, or does not invest adequately in security, individuals should be prepared to seek employment elsewhere. Signs of a good employer include heavy security investment, an executive team and board that pays attention, and a culture that allows security professionals to share learnings externally.

Key Takeaways

• Prioritize Mental Well-being: Security incidents cause significant emotional and mental strain. Proactive measures like mental wellness apps, self-reflection, and positive evidence diaries are crucial for individual and team recovery and sustained effectiveness.
• Translate Risk into Business Impact: To gain buy-in from product and executive teams, frame security vulnerabilities as "scary stories" with clear business consequences (e.g., PR disasters, revenue loss), linking them directly to remediation tasks.
• Drive Accountability with Transparent Metrics: Implement and regularly report on late vulnerabilities by department to executive leadership and the board. This transparency highlights systemic issues and empowers informed decision-making for resource allocation and process improvement.
• Foster a Supportive Work Environment: Companies must empower security teams, respect their expertise, and invest heavily in security. A culture that listens and supports its security professionals is vital for retention and building robust defenses.
• Leverage Community for Collective Strength: Engage in responsible information sharing within the security community (e.g., under Chatham House rules) to learn from others' experiences and collectively improve global security posture.
• Recognize Your Value: Good security professionals always have options. If your current environment does not believe in, respect, or empower your security practice, seek out companies that do.

About the Speaker(s)

Coleen Coolidge is the CISO at Segment, a leading customer data platform. With extensive experience in the security domain, she transitioned to leading security at Bay Area startups in 2014, a move she describes as more fulfilling. Throughout her career, Coolidge has been associated with several successful exits, including an IPO and an acquisition, demonstrating her ability to build and scale security programs in high-growth environments. She is passionate about finding challenging roles at companies that prioritize their people and potential, and she excels at attracting and empowering talented security professionals to work alongside her. Her talk reflects her deep commitment to both technical excellence and the well-being of the security community.