Testing Cyber Resilience Before an Incident With SolarWinds

What does cyber resilience look like when leaders must make a costly decision before anyone fully understands the incident?

In this episode of Tech Talks Daily, I speak with Justin Henkel, CISO at SolarWinds, about moving the security conversation beyond prevention and preparing the wider business to respond, recover, and communicate under pressure. Justin brings 22 years of Air Force experience across intelligence, cyber operations, and special operations, alongside leadership roles in the public and private sectors.

His intelligence background shapes a simple but demanding approach to uncertainty. Technical teams may need time to establish exactly what happened, but business decisions cannot always wait for a complete answer. Leaders need to understand what is known, what remains uncertain, which customers could be affected, and what action limits the potential damage while the investigation continues.

Justin illustrates that tension through an incident involving a database that returned larger responses than expected, including information connected with other customers. The team did not initially know the cause or full extent.

His recommendation was to take the affected product offline while the company investigated. Sales and marketing colleagues were understandably concerned about revenue and reputation, but Justin framed the decision in commercial terms. A temporary loss measured in millions was preferable to allowing one problem to become hundreds of problems with consequences measured in billions.

The incident was ultimately connected with the timing of a database update and a system that failed open rather than failing safely. The example shows why the CISO’s job has expanded beyond explaining technical controls. Security leaders must help executives compare immediate commercial pain with the possible cost of leaving an uncertain situation untouched.