Chris Voss, cyber incidents and the art of staying calm under pressure
Chris Voss is best known for hostage negotiation. But the lessons in Never Split the Difference land surprisingly close to cyber security.
Ransomware demands. Social engineering calls. Fake supplier emails. Cyber insurance claims. Incident updates when everyone wants answers too quickly.
The common thread is pressure.
This page looks at how Voss’s negotiation ideas helped inspire part of the thinking behind Black Swan Cyber Security Solutions and why calm, prepared communication matters when a cyber incident stops being theoretical.
What Chris Voss can teach us about cyber incidents
Cyber security is often treated as a technical subject. Firewalls. Antivirus. Backups. But when something serious happens, people become the hard part: attackers, insurers, staff, clients, suppliers, regulators and decision-makers under pressure.
That is where Never Split the Difference becomes surprisingly useful. Not because cyber security is hostage negotiation, but because high-pressure incidents are full of emotion, urgency, incomplete information and people trying to influence one another.
Who Is Chris Voss?
Chris Voss is a former FBI hostage negotiator and the author of Never Split the Difference, written with Tahl Raz. Before moving into business negotiation training, he spent more than two decades in the FBI, including years working on high-pressure kidnapping and hostage situations.
His approach is built around the idea that people do not make decisions as calmly or rationally as they like to believe. Fear, pressure, ego, urgency and the need to feel heard all shape what people say and do. That matters in business. It matters even more when something has gone wrong.
The book covers practical negotiation tools including mirroring, tactical empathy, calibrated questions, slowing the conversation down, making “no” useful, and looking for hidden information that changes the whole situation.
Voss is not writing about cyber security. But his ideas translate directly into cyber incidents because many attacks are not just technical. They are psychological. They rely on pressure, trust, confusion, authority, timing and the target making a rushed decision.
One of the ideas behind the Black Swan Cyber name
Chris Voss uses the phrase “black swan” to describe the hidden piece of information that can change everything in a negotiation. That idea stayed with us.
In cyber security, the same pattern appears all the time. A business may look protected from the outside, but one overlooked detail can change the whole picture: backups that have never been tested, a mailbox rule forwarding data, an admin account without MFA, an exposed supplier route, or an incident plan nobody has practised.
Black Swan Cyber Security Solutions was built around that way of thinking. Look for the hidden risk before it becomes the thing everyone wishes they had spotted sooner.
Cyber incidents are conversations under pressure.
Ransomware demands, phishing calls, supplier impersonation, insurer questions, staff updates and client communication all involve negotiation of some kind. The person who slows down, listens properly and avoids being pushed into a bad decision usually has the advantage.
Five ways Never Split the Difference maps onto cyber security
This is not about turning business owners into negotiators. It is about recognising the pressure tactics used during cyber incidents and knowing why calm, prepared communication matters.
Ransomware negotiation
This is the most direct cyber connection. When a business is hit by ransomware, the incident may involve real negotiation with a criminal group. That negotiation is not casual messaging. It can affect the ransom demand, the time available, the risk to stolen data and the choices available to the business.
Most smaller organisations do not realise there are specialist ransomware negotiators, incident response firms and legal advisers who handle these situations. The first few hours matter because rushed wording, emotional replies or poorly handled contact can make a bad situation worse.
Question to ask: if a ransom note appeared tomorrow morning, who would be allowed to speak, who would advise you, and who would make the decision?
Social engineering and vishing
Social engineering works because attackers understand people. They create urgency, borrow authority, build false rapport and guide the target towards a decision that feels reasonable in the moment.
Vishing attacks often work because the attacker controls the tempo. They keep the conversation moving, make the target feel helpful, and discourage awkward verification. Good security training teaches people to slow down without feeling rude.
Question to ask: do your staff know they are allowed to pause, challenge and verify unusual requests, even when the caller sounds senior, friendly or urgent?
Business email compromise
Business email compromise is often treated as a technical problem, but many cases are closer to a long-form confidence trick. The attacker may watch email patterns, learn how people write, impersonate a supplier, or wait until an invoice or payment conversation is already underway.
This is why payment change requests, new bank details, urgent invoice queries and senior-leader requests need a process. Not because staff are careless, but because attackers are patient.
Question to ask: would your team verify a bank detail change outside email, or would a believable thread be enough to move money?
Incident response communication
During an incident, the technical response is only part of the job. Someone has to communicate with staff, clients, suppliers, insurers, regulators and sometimes the attackers themselves. Poor communication can turn a contained incident into a reputational problem.
In a cyber incident, people naturally want certainty before certainty exists. That is where mistakes happen: “everything is fine”, “no data was affected”, “we will be back online today”. A better response is clear, calm and careful.
Question to ask: do you have agreed incident communication lines, or would everyone be writing under pressure for the first time?
Cyber insurance claims
After a cyber incident, the insurer will want facts. What happened? When was it discovered? What controls were in place? Were backups working? Was MFA enabled? What evidence exists? These conversations need care.
This is one reason cyber insurance readiness matters before a claim. If your security controls, backup testing, patching, endpoint protection and staff training are documented properly, the conversation is easier and less frantic.
Question to ask: if your insurer asked for evidence tomorrow, could you show it quickly, or would you be trying to reconstruct it after the event?
Voss’s negotiation ideas as a cyber risk framework
The useful part is not becoming clever with language. It is understanding how pressure works, then building processes that stop people being pushed into poor decisions.
Tactical empathy
Understand the other party’s pressure, motives and language without handing them control.
Mirroring
Slow the conversation and draw out more information instead of rushing to answer.
Calibrated questions
Use “how” and “what” questions to test claims and avoid being forced into false choices.
No as a tool
Make it safe to pause, challenge and verify. In cyber security, a polite “no” can stop fraud.
Find the black swan
Look for the hidden fact that changes the incident: access, motive, data exposure, backup state or scope.
This is why preparation matters before the incident.
You do not want your first serious cyber decision to happen when email is down, staff are worried, a ransom note is on screen, and someone is asking whether you have told your insurer.
Attackers use urgency.
Good procedures remove some of that power. Payment checks, MFA, backup testing, call-back verification and incident plans all give people permission to slow down.
Evidence beats panic.
When you can show what was protected, monitored, backed up and tested, conversations with insurers, clients and advisers become more grounded.
Communication needs owners.
Staff updates, client notices, insurer contact and technical decisions should not be improvised by the nearest person with a keyboard.
Negotiation is not DIY.
Ransomware contact should involve the right legal, insurance and incident response advice. Curiosity or panic can make the situation worse.
Read the book, then check your own pressure points.
Never Split the Difference is worth reading for the negotiation lessons alone. From a cyber security point of view, it is also a useful reminder that the weakest moment is often not technical. It is the moment someone is rushed, flattered, frightened or pushed into acting before they have verified the facts.
Disclosure: the book link on this page is an affiliate link. If you buy through it, Black Swan Cyber Security Solutions may receive a small commission at no extra cost to you.
Part of the books that shaped Black Swan collection
Chris Voss’s work is one of several influences that helped shape how Black Swan Cyber Security Solutions thinks about pressure, communication, trust and practical cyber security advice.
You can also read how Nassim Nicholas Taleb’s work shaped our thinking on uncertainty and hidden risk, how Marcus Sheridan influenced our trust-first content approach, and how Daniel Priestley’s ideas apply to visibility and accountability in cyber security.
Would your business stay calm under pressure?
We help smaller organisations understand where they stand: endpoint protection, email security, Microsoft 365 risks, backups, staff training, cyber insurance readiness and incident response planning. No scare tactics. No jargon. Just a clear look at what would happen if something went wrong.