After the Call

Every company that gets breached says the same things in a different order. We have backups. We think it's contained. The MSP is on it. The board doesn't know yet. Travis R Barlow has taken that call more than six hundred times over twenty-six years, for manufacturers, law firms, municipalities, credit unions, and logistics companies across Canada. After enough of them, the incidents stop looking like incidents and start looking like a small number of patterns wearing different clothes. After the Call is thirty of those patterns. Each chapter tells one incident the way it happened in the room, and argues one lesson from it. The backups that were green for two years and took nine days to restore. The ransom negotiation where the attacker knew the insurance limit before the CFO did. The 24/7 SOC that turned out to be a shared mailbox. The tabletop exercise that predicted the breach eighteen months early and went into a drawer. The company that recovered in 72 hours and lost a customer, a payroll, and three staff in the quarter that followed. The incidents are composites. Names, dates, and identifying details are changed or blended, and no company is named. If you think you recognize yours, what you're recognizing is the pattern. This is not a checklist and not a framework. It's what the lessons cost when they were learned the expensive way, and what to do about each one before your own Friday night. For owners, executives, board members, and the IT leads who answer to them.