You wouldn’t believe how many startup CEOs I talk to who would be royally screwed if one of their vendors got hacked. A few months ago, this wouldn’t have mattered for most startups. But we’re entering cyber armageddon. This is going to happen to you. It’s just a question of when. The good part is that it’s very manageable. You just need the right mindset and a few processes in place before anything happens. Here’s what I’d be thinking about today. First (don’t kill me): do you have cyber insurance? And the real question: have you ever actually talked to your broker about using it? I know this is the last thing you want to deal with, and it’s boring as hell. But please, please call them and make them walk you through it. If your cloud provider gets breached tomorrow, who do you call? What help do they arrange? What needs their approval? What do you pay out of pocket? Get the actual phone number, and save it somewhere you can reach if your work email is down. Then figure out if your lawyer handles breaches. If they don’t, ask who does and get introduced. Find out how hiring them works with your insurance. You want to know this person exists before you need them. Next, pull up your customer contracts, especially the big ones. What did you agree to tell them if something happened? You’d think every CEO would know this by heart. Almost none of them do. What triggers a notification, and who’s supposed to get it? Have someone qualified work through it with you, right now. You might have agreed to something eight months ago and forgotten. Someone at the customer may remember, and if they do and you don’t, you could be very liable. One angry customer with a contract claim can be enough to sink a startup. Same deal with any security questionnaires you filled out. What did you say you do? Are you doing it? Is it still true? Then come the business problems. How long could your product be down before you have a real cash problem? What if a big customer pauses payment while you’re also paying outside help? Run the numbers and see where things get uncomfortable. And who can spend money in an emergency? If everything needs your approval and you’re asleep or on a plane, what happens? Who can take the product offline? This came up in the replies to my last post. Rotating keys can mean an outage, and someone has to decide whether to accept it. Figure out who has that authority before it matters. Who talks to customers while your engineers are busy? Give that job to one person and make sure they get accurate updates. Otherwise your engineers are investigating while answering the same question from five people. You can draft the bones of those updates now: what we know, what we’re checking, what you need to do, when we’ll update you next. Leave room for uncertainty, and don’t promise things you haven’t confirmed (this happens more often than you think, and can get you in hot water). Have someone keep a timeline: facts, times, decisions, things you tried that didn’t work. Everyone will be tired and distracted. You will forget. And where does all of this live? If your plan, contracts, and contacts are all behind the login that’s down, you have a second problem. Try reaching what you’d need without your normal work setup. Make damn sure you can (offline copies are useful here). Take a look at what you’re exposing, too. Old customer files, exports, recordings, and especially whatever your agents can access. Do you need all of it? Who decided to keep it? Who knows everything you’ve connected, what your agents do during an investigation, and where they’re sending information? Someone needs to own those questions, because every piece of it is future work if something goes wrong. Then practice. Sit down with whoever would be involved and walk through it. At some point everyone will look at each other and nobody will know the answer. Write that down, and start there. Bookmark this so you have it when you need it.

I used to be the person companies called after they got hacked. And I noticed something early on. The hack almost never sank them. The cover-up did. Every time, the team’s instinct was the same: wait until we know more, wait until we're sure, wait until we have the perfect statement, etc. And some of the biggest companies in the world have learned what that waiting costs. In 2016, Uber got hacked. Instead of telling anyone, it paid the hackers $100K to delete the data and stay quiet, and labeled it a bug bounty. The truth came out a year later. Uber paid $148M to settle with all 50 states, and its former security chief was criminally convicted. That same year, Yahoo revealed that a 2014 breach had exposed 500M accounts. The news landed in the middle of Verizon buying the company. Verizon cut $350M off the price. And in 2017, Equifax discovered a breach affecting over 140M Americans, then waited 40 days to tell the public. During that window, an executive who'd figured out what happened sold nearly $1M in stock. He went to prison for insider trading. Meanwhile, hackers don't wait. They post your data. They email your customers directly. And when customers hear it from a stranger first, that trust is gone for good. Telling customers early doesn't mean admitting fault. It can be as simple as: "We found suspicious activity. We're investigating. Here's what you should do right now. We'll update you as we learn more." On Tuesday, I'm sharing the exact framework I'd use to write that email if I were in your shoes. Follow and turn on notifications so it's there when you need it. Customers will forgive you for getting hacked. Most of them expect it by now. What they won't forgive is finding out you knew and said nothing.