Notifications
Clear all
Topic starter
02/08/2026 12:27 pm
TL;DR: Nearly 70% of CISOs felt pressured to cover up a security incident, underscoring how liability fears, unclear incident boundaries, and fragmented environments can distort disclosure decisions and weaken organisational learning, according to Mind. The governance problem is no longer disclosure mechanics alone, but the culture and control design that shape whether leaders can report accurately under pressure.
NHIMG editorial — based on content published by Mind: The pressure to stay silent, a growing risk to cybersecurity
By the numbers:
- Nearly 70% of CISOs have felt pressured to cover up a security incident.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
Questions worth separating out
Q: What breaks when leaders feel pressured to hide a security incident?
A: Disclosure becomes slower, narrower, and less reliable.
Q: Why do identity controls matter to incident disclosure?
A: Because incident reporting depends on trustworthy evidence about who accessed what, when, and through which account or token.
Q: How do security teams know whether incident governance is working?
A: Look for whether the organisation can reconstruct the incident timeline, identify the approvers for high-risk decisions, and produce consistent internal and external statements.
Practitioner guidance
- Establish protected incident disclosure paths Create a reporting route that separates initial fact capture from disciplinary review, so CISOs and incident leads can escalate suspected breaches without first calculating personal exposure.
- Correlate identity telemetry before the next incident Make privileged session logs, service account activity, OAuth grants, and authentication records available in one incident view.
- Run disclosure-focused tabletop exercises Test not only containment and recovery, but also who decides what the organisation can say, when it can say it, and what evidence is required to support the statement.
What's in the full article
Mind's full post covers the leadership, legal, and cultural detail this analysis intentionally leaves for the source:
- How the Bitdefender survey data was framed and discussed in the original commentary
- The incident-liability example cited around the Uber case and its effect on executive behaviour
- Direct quotes from MIND leadership on transparency, blame, and organisational trust
- The article's broader argument for no-fault learning and sentinel-event style review
👉 Read Mind's analysis of CISO pressure, incident silence, and breach disclosure →
Ciso silence on incidents: what it means for governance teams?
Explore further
02/08/2026 1:26 pm
Silence is a governance control failure, not just a leadership lapse. When CISOs feel pressure to conceal or soften incidents, the organisation loses incident fidelity at the moment it needs it most. That failure affects response, disclosure, auditability, and board oversight. In practice, this is a NIST CSF governance issue as much as a communications issue, because the quality of the response depends on the truth available to decision-makers.
A question worth separating out:
Q: Who is accountable when a breach is not reported or documented correctly?
A: Accountability usually sits across security, legal, and operational leadership, but the checklist must make ownership explicit. Reporting deadlines, evidence preservation, and post-incident documentation should be assigned to named roles before an incident happens. That avoids the common failure where everyone assumes someone else handled regulatory notification or records retention.
👉 Read our full editorial: Ciso silence and breach cover-ups are becoming a security risk
