Why incident response breaks down when it matters most