Key Takeaway: The article below, originally published in Cybersecurity Law & Strategy, outlines five steps organizations should take before a cyber incident strikes. By establishing decision-making authority, prearranging response services, and taking an intentional approach to other crucial preparations, teams avoid costly and rushed decisions should a cyber incident occur.

Some of the world's leading AI companies are spending considerable time preparing for something they sincerely hope never happens: a catastrophic AI-related event.

According to an October 2026 Axios report, executives at OpenAI, Anthropic, and other major AI developers have been considering the aftermath of a serious AI-related crisis, including scenarios involving cyberattacks capable of disrupting financial systems, internet connectivity, and critical infrastructure. The discussions reportedly extend beyond preventing such events to understanding their potential consequences.

This development is particularly interesting for organizations that have spent years investing in cybersecurity defenses while giving far less attention to what happens after those defenses fail.

To be clear, these discussions do not suggest that any particular catastrophe is imminent or inevitable. Rather, they demonstrate a recognition that prevention alone is not a complete risk-management strategy.

And that raises a fairly straightforward question: If organizations are willing to plan to head off the possibility of a major cyber incident, why not also make advance arrangements for the services required to respond to one?

The Challenge: When the Incident Becomes Everyone's Problem

Routine cybersecurity operations are generally designed around prevention, detection, containment, and recovery. But hardening one’s defenses is not sufficient. Organizations must also consider incidents originating outside their own environments. Verizon's 2026 Data Breach Investigations Report identified third-party involvement in 48% of the breaches it analyzed. Moreover, even an organization that invests heavily in its own security infrastructure can still find itself responding to the compromise of information maintained by a trusted provider.

Only once a cyber incident occurs do many organizations realize that they must sort out lines of responsibility and decision-making authority, the specifics of coordination across units of the organization, budget, and selecting vendors. Often, organization also discover that they are not sufficiently equipped to manage large-scale data mining, document review, individual identification, notification production, or months of post-incident support.

These after-it-matters-most discoveries compound what very often proves to be among the most disruptive events in corporate life: learning that your organization may have experienced a serious cyber incident.

Initially, information is incomplete. Your security team is investigating, executives want answers, and legal counsel is working to understand the organization's potential obligations. Nearly everything takes a back seat to those efforts.

As the investigation progresses, the situation can become more complicated. Determining which systems were compromised is one thing. Understanding what information was affected, identifying the individuals associated with that information, and determining whether notification is required is an entirely different undertaking.

Throughout, the financial stakes demand attention. According to IBM's 2026 Cost of a Data Breach Report, the global average cost of a data breach reached US$4.99 million. The report also identified a $6 million average cost for AI model inversion attacks, illustrating some of the emerging risks associated with increasingly sophisticated technologies.

These figures include broad financial consequences such as business disruption, investigation, and recovery. They are not simply the cost of sending notifications. Nevertheless, they provide a useful indication of potential financial exposure.

The bottom line is that having a plan to stop an attack is not the same as having a plan to manage the consequences. Mitigating the fallout requires, first, understanding four key considerations and, second, taking five critical steps. 

Key Considerations for Effective Breach Preparedness

1. A Cyber Incident Is Not Exclusively an IT Problem

Security professionals will lead much of the technical response, but a significant incident quickly involves other parts of the organization. Legal counsel must evaluate regulatory and contractual obligations. Finance must track escalating expenses. Procurement may need to engage specialized providers. Communications teams must prepare for questions from employees, clients, regulators, and other stakeholders. Someone also needs the authority to make decisions, approve expenditures, and coordinate all of these activities.

It is much easier to establish those responsibilities during normal business operations than during an emergency. A list of names and telephone numbers is helpful, but it should not be mistaken for a fully developed operating plan.

2. Understanding the Breach Requires Understanding the Data

Identifying a compromised server or a collection of files doesn't necessarily identify the individuals whose information may have been affected. That determination requires examination of substantial volumes of structured and unstructured data, identifying sensitive information, resolving duplicate records, and creating accurate populations for potential notification.

Depending on the circumstances, this can become one of the most labor-intensive (i.e., expensive) elements of a response.

Organizations that understand where their data resides, how it is maintained, and which third parties hold it are in a better position to begin that work. Establishing access to experienced data mining and review resources beforehand eliminates an additional round of provider evaluations and contracting when time is already limited.

3. An Active Breach Is a Poor Time To Begin Negotiating Contracts

Under ordinary circumstances, businesses invest considerable effort in selecting service providers. They compare capabilities, review pricing, negotiate terms, and establish expectations before authorizing substantial expenditures. And for some reason, those same disciplines are occasionally deferred when it comes to cyber incident response.

Unfortunately, none of these activities become easier when an organization is managing a breach, regulatory deadlines are approaching, and specialized services are urgently needed. Prearranged agreements establish pricing structures, service expectations, information security requirements, and activation procedures before those pressures begin.

While the financial benefits will vary by incident, the underlying business principle is familiar: having time to make informed commercial decisions is generally preferable to having no time at all.

4. The Response Must Work as a Coordinated Process

A cyber incident response involves multiple interconnected activities. Forensic investigators assess what occurred. Counsel evaluates the legal implications. Data specialists identify affected information and individuals. Notification teams prepare communications. Call centers and monitoring providers support those individuals after notices are delivered.

These activities cannot always proceed independently. Each relies on information, decisions, or deliverables from another. Uncoordinated handoffs introduce delays, duplicate work, and additional complexity.

Establishing relationships with a partner capable of supporting the full response lifecycle enables organizations to define those workflows in advance. They coordinate the movement of information and maintain continuity throughout the response.

What Organizations Can Do Now To Prepare for a Breach

Fortunately, organizations don't need to wait for an incident to address these concerns. Several strategic steps can be taken while circumstances are considerably less demanding.

Establish a response leadership structure. 

Identify the internal executives, security personnel, legal counsel, insurers, and external specialists who will be involved. Define decision-making authority, escalation procedures, and financial approval responsibilities.

Understand the data environment. 

Determine where sensitive information resides, which third parties maintain it, and how it could be accessed and evaluated following an incident. Include AI applications and associated information flows in that assessment.

Arrange response services in advance. 

Evaluate partners capable of supporting data mining, document review, notification list development, and print and electronic notifications, as well as call centers and personal monitoring. Establish appropriate agreements, pricing structures, and activation procedures before an emergency.

Review insurance and financial requirements. 

Understand the organization's coverage, deductibles, carrier consent requirements, and any preferred provider provisions. Establish a process for monitoring incident-related expenditures as they occur.

Test the complete response. 

Tabletop exercises should involve more than the technical response team. Include legal, finance, procurement, communications, and operational service providers. Practice the transition from investigation and containment into data review, notification, and post-incident support.

Preparing Your Organization For a Material Breach

With AI now deeply integrated into business operations, organizations are inevitably encountering new risks involving data governance, third-party dependencies, and increasingly sophisticated cyber threats. Those developments deserve continued attention, as do changing legal requirements, insurance expectations, and the expanding complexity of incident response. But organizations should not allow the search for better preventive technology to overshadow the preparations needed when an incident actually occurs.

A useful exercise is to consider what would happen if a material breach were discovered tomorrow.

Would the organization know which providers to engage? Would the necessary agreements already exist? Could data review and notification operations be activated without beginning a new procurement process? Would leadership understand how those services would be coordinated and paid for?

If the answer to several of those questions is no, there is still work to do.

Effective Cyber Resilience Starts Before the Incident

The contingency planning reportedly taking place within leading AI companies offers a lesson applicable to organizations across every industry. Recognizing that a serious incident is possible should lead to preparation for its consequences, not simply further investment in preventing it.

Advance planning will not eliminate the possibility of a breach, and no responsible provider can guarantee the cost of responding to one. It can, however, establish the relationships, commercial arrangements, and operational processes that organizations may otherwise find themselves developing under extraordinary pressure. 

© Copyright 2026 ALM Global, LLC. Reprinted with permission. This article originally appeared in the November 2026 issue of Cybersecurity Law & Strategy. Read it here.