Whether they’re embarrassed or afraid of being shown up or for whatever other reason, they’re uncooperative or in some cases actively working against our investigation.

So on a recent case, during our engagement kick-off call, I laid it out like this. “We’re going to investigate and figure out where this started. And it will be an unpatched system, or somebody clicking a link, or somebody just being unlucky with a web site they visited.”

“And NONE of that is YOUR FAULT. All organizations are vulnerable, because I have yet to meet an org whose security budget exceeds their attack surface.”

“You are not the assholes here. The assholes are the ones who took that vulnerability and used it to drop ransomware all over your network. Just because you forgot and left your door unlocked doesn’t make it right for somebody to come in and trash your place.”

“We are the good people. The ones who are trying to figure out what happened and make things better. This is a team effort that is going to require everybody’s help. Nobody is to blame, we are all just trying to fix this mess we find ourselves in.”