Organizations spend considerable time preparing for the technical realities of a cyber incident. Detection capabilities, containment procedures, recovery plans and governance structures are all essential. Yet many of the factors that shape the success of a response have little to do with technology.