Breach Commander roles : Who's behind the keyboard
- JS Gervais
- Mar 7
- 2 min read
Updated: Mar 8
The DNA of Breach Commander is incident management. Typically it starts with somebody having a considerable problem (cyber or otherwise). Then BC helps dealing with the situation, document everything properly along the way, and finally report on who/what/when/how.
But who actually is using Breach Commander during an incident?
Defining who is behind the keyboard will simply depend on who is responsible for incident response within your organization. This can include:
A local operations team handling incidents internally;
A external cybersecurity provider, also getting involved in incident response;
A specialized outsourced incident management partner;
A dedicated Breach Coach overseeing privacy and legal aspects.
BC is flexibly designed to support any such model.
Invite to the table and assign a role to whoever you see fit.
The incident management roles can be assigned to the proper people, whether internal or external, depending on the situation. The roles can be reassigned at will, including for shift changes.
We will cover user creation in a future article, but any person can be invited as long as they have an email address! Don't worry, data access permissions keep you in control.

Role: Incident Commander
Incident central leader who can manage the crisis calmly, assign work and report to the business.
Role: Business Lead
Leader who deeply understands the business's critical functions, including management, sales, finance, legal, HR, risk and operations.
Role: Technical Lead
Leader knowledgeable of practical aspects related to the affected business technologies, machines, and how things work.
Role: Auditing Lead
The auditor in charge of the case, who can create, fill-in and sign audits.
Visit breachcommander.com and join the conversation about roles!
Comments