Scratch Pad: Where Cybersecurity Incident Response Teams Work, Share, and Stay Aligned
TL;DR: BreachRx introduces Scratch Pad – a collaborative document workspace built directly into incidents and exercises in the Rex Platform. It gives response teams one protected, real-time place to capture findings, hypotheses, handoffs, decisions, and communications so everyone stays aligned without chasing information across chats and standalone documents.
We’ve all been there before. Something goes wrong or gets escalated, an incident is called, and a group (hopefully from more than one department) is assembled to figure out what’s happening and how to address it. Situations like this are urgent and there are always multiple moving pieces; assessing the issue, figuring out the remediation steps, and deciding how to communicate to internal and external stakeholders what happened.
Regardless of our role within our company or team, there are meetings, chat channels, and messages flying around, while contributors are doing their best to document what they can in a hurry. Notes are taken during meetings, about investigation details, decisions made, and planned actions. While attempts are often made to keep some of this somewhere central, it’s usually in a standalone document, and contributors keep notes for their assigned activities in their own docs and notes apps. With conversations happening in all these different places, it’s really common that important information falls through the cracks.
To be clear, no one is doing anything wrong by leveraging the tools available. This is the legacy of the field of incident response. Common challenges are keeping everyone on the same page during, after, and between meetings, making important decisions in a timely fashion without forgetting key steps, and keeping everyone across the organization on track. All this, and it’s easy to lose sight of what’s occurred. The most common hard problem is being able to answer the question that inevitably comes when another team member joins the effort: “Can somebody catch me up?”
The Fragmentation Trap
It’s an Organization Problem, Not a Knowledge Problem
The cost of this fragmentation means that it’s a significant challenge, if not impossible in some cases, to keep all of the pertinent information available to everyone who needs it. It’s not a context issue, it’s an organization issue. When incidents can cause dozens of channels to be spun up (true story), chasing the details takes time, significant effort, and can lead to misunderstandings or team members operating without the most current information. That time is better spent working on the issue. The team members working at a knowledge deficit may make mistakes, miss critical actions, or rework activities that have already been completed or worse, work on activities it’s already been decided aren’t necessary. In the worst-case scenario, there are team members operating with conflicting versions of the truth.
There’s also a legal risk that’s easy to miss in the moment. When incident details are spread across everyday chat channels and general-purpose docs – the tools your teams use for regular business – it’s much harder to protect under legal privilege. Anything that isn’t protected can be pulled into later litigation or a regulatory inquiry, which means the notes taken in a hurry in order to move faster can end up discoverable evidence that works against the very team that created them, and can create massive additional work later.
Compounding Operational + Legal Risk
Stop Choosing Between Talking and Keeping
Again, it’s important to know that the tools you’re currently using aren’t the problem.
Chat is for talking. It’s fast, linear, and potentially somewhat ephemeral, depending on your organization. It’s a fantastic tool for quickly connecting, discussing work items, making quick decisions, or sharing findings. The challenge is that it scrolls – often quickly, given the pace of the work at hand – with details buried between jokes, mundane messages, and side conversations. On top of that, searching after the fact can be tedious, especially in high-velocity environments. For anything that needs to be shared or potentially reviewed by other team members, you need something more permanent.
That brings us to documents. Documents are great for brainstorming, thinking, and keeping things recorded in an easy place to refer to later, because they’re unstructured. How much easier is it to search a document than to chase down a specific detail in a chat application? That permanence is what makes document formats powerful for teams who are collaborating on complex issues. The trick is making sure you’re all recording information in the same place. But the lack of structure means it’s easy to lose sight of connecting the trees to the forest, the details to the overall incident.
This is why many teams will assign an incident scribe or similar role to an individual. While this is a good practice for meetings, documents often inadvertently become single-author. One person owns it, and everyone else waits or offers edits. To be truly responsive, aligning your team on a single source of truth for your incident is an important step towards a truly shared understanding. When the place you collaborate is the place where work is recorded, documenting the details stops being a task you do later and starts being something that just exists when you’re done.
Talking vs. Keeping
One Workspace, Built Into the Incident
Seeing these challenges in the real world as we work with our customers on their incident readiness is what drove us to add Scratch Pad to the BreachRx Rex Platform. Given that none of what teams are writing down is exotic and that coordinating teams already produce this information, keeping it in one place ensures that ownership is shared and everyone is up to date.
From Fragmentation to Shared Understanding
Scratch Pad provides that one place, a collaborative document workspace that is built directly into the incidents and exercises themselves within the BreachRx Rex Platform. It lives where the response already happens, so there’s no need for managing multiple documents or resources. There is one central place for collaboration, already available to all of the team members to get started when jumping into cybersecurity incident response.
Edit in real time in a shared space where multiple team members can write at once and see each other’s changes live. No more chasing the latest version of a document. Collaborate right in the incident itself, sharing critical details. Draft as a team with rich structure, such as headings, lists, multiple formatting options, along with images and video to meet the needs of your incident. And Rex AI Maestro has your back to aid in connecting the work back to the structured workflows necessary to ensure you don’t miss any steps.
Since you’re already inside the incident, Scratch Pad becomes part of the shared understanding, allowing teams to quickly hypothesize, share findings from investigations and remediation details, and draft communications. Support for mentions and comments allows you to notify other team members when their attention is needed, or just identify who owns parts of the conversation. And, best of all, it can be placed under legal privilege protections that will stand up far better than a chat or document system that’s also used for regular business.
Scratch Pad is available to all BreachRx customers today.
Move as One When It Matters Most
Shared Understanding as a Side Effect
The most effective coordination processes don’t require people to chase down details across multiple tools, calls, and conversations, while managing access for multiple artifacts. They instead promote shared understanding as a side effect of being able to work and collaborate effectively. Whether the situation is a security incident, a critical outage, or any moment where teams have to move together under pressure, having a protected, centralized source of truth allows teams to move as one when it matters most.
This is the same ethos that runs through the BreachRx Rex Platform: Response works better when coordination, communication, and the record are all managed in one connected place.
