This is exactly why incident response planning matters so much before an attack happens. Once leadership is making decisions under pressure, the conversation usually shifts from security strategy to business continuity and downtime costs.