Thank you @SCBuergel for opening this consultation. I would like to contribute some observations on a dimension that may be worth including in the framework: organisational resilience and human factors.
This captures something important. If Gnosis determines that intervention capability is appropriate, that capability needs to be designed – not improvised. Improvisation is often a symptom of under-resourcing.
I agree. But whether the focus is prevention or response, both require sustained investment – in tooling, in monitoring, and in the people who operate them.
The current context
This framework is being developed at a moment when teams have responded to a series of incidents in quick succession. That context matters. If personnel are already stretched – carrying accumulated fatigue, deferred leave, and backlogs from recent events – then any framework that assumes they can simply respond to the next incident is building on a fragile foundation.
It is worth asking: what is the current state of the people who would be called upon to execute this framework? If capacity is already running thin, that is not a criticism of those involved – it is a signal that the organisation needs to invest in recovery before the next event, not just in processes for when it arrives.
Human factors as a framework consideration
Any intervention framework that assumes personnel will be available to execute it needs to account for human factors. High-reliability industries – aviation, nuclear power, emergency medicine – have long recognised that technical capability alone is insufficient. The framework should consider:
- Headcount: Sufficient depth to allow rotation during extended operations
- Surge capacity: Retainers, partnerships, or standby arrangements
- Training: Regular exercises, documented runbooks, clear escalation paths – and specific training in human factors such as communication under pressure, fatigue recognition, and structured decision-making
- Sustainable baseline: Teams that are chronically stretched have reduced capacity to respond when needed. Recovery time between incidents is not a luxury; it is a prerequisite for reliable performance.
The aviation industry calls this “just culture” – the principle that safety depends on honest reporting, and honest reporting depends on distinguishing between systemic failures and individual culpability. The objective is to learn, not to punish. This principle might usefully inform how post-incident reviews are conducted.
The accountant’s question
There is a straightforward way to frame this: if Gnosis wishes to maintain intervention capability, the cost of maintaining that capability should be budgeted explicitly. This includes:
- Internal headcount with appropriate depth
- External retainers or partnerships with security firms
- Comprehensive bug bounty programmes that incentivise responsible disclosure across the full stack
- Training and exercises
- Recovery capacity: Time and resources for teams to decompress between incidents
Treating emergency response as an externality – absorbing the cost through goodwill and overtime – creates fragility and deprives the organisation of the information needed to make informed resourcing decisions.
Part of defining that future is ensuring that whatever framework is adopted, the people who will be called upon to execute it are set up to succeed – not just in terms of tools and processes, but in terms of sustainable working conditions and appropriate training. That starts with acknowledging the current state of those teams and investing in their recovery.