A Conversation With Matt Hartley

Technological concepts & product/approach highlighted

Why incident response must change (beyond “hero mode”)

• Traditional incident response often depends on a few experts (“jump in and save the day”), which creates scalability and availability risk (e.g., key people on vacation).
• With AI-driven attacks—and easier attacker tooling enabled by large language models—the industry needs a more systematic, repeatable approach.

How AI changes the incident landscape

• Attack automation and intelligence are increasing, and large language models can make attacks easier to carry out.
• Defenders are improving detection capabilities (e.g., long-term gains using ML for visibility), but incident pace and attacker capability still outstrip many teams.
• Greater adoption of AI tools by businesses also expands:
  • Governance concerns
  • Third-party / supply-chain risk (“third-party compromise, fourth-party compromise…”)
• An example scenario described: a CISO’s experience shifting from a handful of incidents per year to at least one incident at all times.

Core recommendation: “Rethink readiness”

• Readiness is not a static plan/binder/document.
• The speaker argues for building:
  • Impact-specific procedures (e.g., third-party incidents vs. “AI gone wrong” vs. malware/ransomware—each requires different response actions)
  • Incident response as an enterprise/business problem, not only a technical security task
• Emphasis on cross-functional preparation (security + legal + comms), because teams can otherwise “talk past each other” during crises.

Threat scenario analysis + prevent/detect/respond

A tutorial-like consulting workflow is described:

1. Build a top-10 list of worst-case business-impacting scenarios
2. For each scenario, assign checkmarks/X’s for Prevent / Detect / Respond
3. Run a top-down workshop with executives (CEO, CFO) and relevant leaders (security, legal)

Key point: scenario-specific runbooks (including legal steps) make a dramatic difference—described as “absolutely insane” compared to having none.

“Train like you fight” / muscle memory

• Analogies from military and aviation are used to argue that effectiveness comes from practice, not just documentation.
• Customers are moving from annual tabletop exercises to more frequent micro-simulations (e.g., bi-weekly), involving security + IT + legal to build routine response behavior.

Main product concept: BreachRX platform for automated readiness, training, and response

A SaaS platform intended to help organizations:

• Import procedures quickly
• Break incident processes into modular tasks
• Run training/exercises inside the platform
• Execute the correct response procedure set when an incident is created

“Maestro agents” for orchestration

Maestro agents (coordinator + “workforce of agents”) are central to orchestration:

• Lead/run incidents
• Handle regulatory and legal-related tasks
• Coordinate templates/communications

Fast onboarding / rapid value

• Some customers can handle a real incident the same day they’re provisioned (initially with default setup).
• The goal is customization and practice.
• Customization onboarding varies: weeks to a few months.
• Example success: a customer operationalized and tested 9 plans within 90 days.

Modularity & evergreen maintenance

• A pain point: teams often maintain multiple runbooks with overlapping sections (e.g., triage tasks), forcing updates in many places.
• BreachRX approach:
  • Modularize procedures (e.g., shared triage/RCA components)
  • Maintain fewer reusable task blocks
  • Select the right procedures dynamically based on incident type creation source (ticketing/security tools/API/UI)

UI/operational usability for non-technical stakeholders

• The interface is designed for legal/comms/executives, not only security analysts.
• During crises, it provides an out-of-band, protected (potentially privileged) workspace to guide structured tasks instead of panic.

AI features mentioned

“One-shot” capabilities

• Rewrite/update artifacts
• Generate or summarize templates
• Assist with incident capture/structuring (turn “what happened” into structured tasks)

Scenario generation workflow

• Use threat intel/news → generate a realistic scenario → run an exercise → derive lessons learned and update procedures
• Timing is described as fast: “in 30 minutes” to a couple hours depending on scale.

Future direction

• Increase training frequency and continue modular plan execution and operational streamlining.
• Use AI to help smaller teams act like larger, more experienced ones (e.g., “3 or 4 people act like a team of 15 or 20”).
• More emphasis on consistency and accountability during crisis execution.

---

Key review/tutorial/guide-style elements

• Threat scenario analysis workshop method
  • Top-10 scenarios
  • Prevent/detect/respond scoring
  • Include CEO/CFO/legal/security leadership
• Checklist/SOP mindset
  • Consistent procedures encode hard-won expertise
  • References include the Checklist Manifesto
• Training cadence change
  • From annual tabletop exercises to bi-weekly micro simulations
• Runbooks must be impact-specific and aligned to business functions
  • Legal/comms/leadership inputs are required

---

Main speakers/sources

• Matt Hartley (guest; BreachRX)
• Daniel (host; interviews Hartley)