A company loses customer data in a breach on a Tuesday afternoon. By Wednesday morning, three people in the building are looking at the exact same incident and reaching three completely different conclusions about what to do next.

The engineer wants to know what actually happened — which server, which vulnerability, how it can be reproduced and fixed. The manager wants to know what it costs, how bad the headline will be, and whether customers will leave. Neither of them is wrong. They're just answering different questions.

Then there's the third person in the room, usually the one everyone forgets to invite until something goes wrong. That person is running on a legal mind, and their first question isn't "what happened" or "what does it cost" — it's "what rule governs this, and did we break it." Notification deadlines, contractual obligations to clients, regulatory exposure. A different lens entirely.

The Rule-First Approach

Legal reasoning starts from the rulebook, not the facts on the ground. Before asking whether the breach was serious, it asks whether a specific reporting deadline has already started ticking.

This can look oddly detached from the human side of the problem. It isn't cold indifference — it's recognising that missing a 72-hour notification window creates a second, entirely avoidable problem on top of the first one. Rules don't care how sorry anyone feels.

The downside of this approach on its own is speed. Waiting to map every applicable regulation before doing anything can leave a genuine emergency unmanaged while the paperwork gets sorted.

The Evidence-First Approach

The engineer's instinct is almost the opposite. Find the cause, reproduce it, confirm it, then talk. Nothing gets stated as fact until it's been checked, which is exactly the discipline that keeps a company from issuing a public statement it has to retract two days later.

This mindset trusts data over assumption every time. It's slower to draw conclusions, but the conclusions it does draw tend to survive scrutiny.

Where it struggles is under pressure to act before all the evidence is in — which, in a breach, is almost always. Waiting for certainty in a fast-moving situation has its own cost.

The Return-First Approach

The manager's question is blunt: what does this cost, and what's the smallest cost path out of it. Not because they don't care about the customers affected, but because a business that doesn't survive the breach can't help anyone either.

This mindset prices risk and moves. It's comfortable making a call with incomplete information, because waiting for perfect information is itself a cost.

The weak spot is obvious once things go wrong badly enough. A business mind can underweight a rare but severe outcome, because the spreadsheet rarely has a row for "this destroys the company's reputation for a decade."

When the Three Clash

The interesting moment isn't when these three agree — it's when they don't. The engineer says the system's fixed and the risk is basically gone. The lawyer says the notification obligation still applies regardless of how quickly it was patched. The manager wants both of them to hurry up because every hour of silence is another headline risk.

None of them is bluffing or being difficult. They're each optimising for a different definition of a good outcome, and a company that only listens to one of them tends to get burned by whichever question it ignored.

The best outcomes in situations like this usually come from someone forcing all three into the same room, on purpose, before a decision gets made.

Why It's Worth Borrowing All Three

Most people default to one of these three modes without noticing, usually the one closest to their own job. Engineers trust data. Managers trust numbers. People with legal training trust rules and precedent.

Recognising which mode you're stuck in is the first useful step. The second is deliberately borrowing from the other two before committing to a decision — asking "what does the rule say" even if you're not a lawyer, or "what would this actually cost" even if you hate spreadsheets.

Conclusion

None of these three ways of thinking is the "correct" one in isolation, and a workplace that only rewards one of them will keep making the same category of mistake. Borrowing the rule-first habit from legal reasoning — checking the obligation before reacting to the emotion of a crisis — is a useful add-on even for people who will never set foot in a courtroom. The goal isn't to think like a lawyer all the time. It's to know when that lens is the one missing from the room.