On the same morning: a new critical vulnerability is being exploited in the wild, the CISO wants a board paper by Friday, and IR needs support on a live case. You cannot do all three. How do you decide?

I would not answer this by claiming I could do all three. The point of the question is the decision rule.

My rule is decision impact against time sensitivity: for each item, what decision does it support, when is the decision point, and what happens if it slips.

But before ranking I would spend maybe an hour triaging all three, because that hour usually changes the ranking. On the vulnerability: is it actually exploitable in our environment, is it internet-facing, do we have compensating controls? A critical CVSS score in software we do not run is not urgent, and this is exactly where intelligence adds value — filtering the noise rather than amplifying it. On the incident: what does IR actually need, and is it something only I can provide? Sometimes it is thirty minutes of context rather than a day of support. On the board paper: when is the meeting, and what decision does the paper serve?

After that triage the ranking is usually obvious. Live incident support tends to win because the cost of delay is immediate and irreversible, but I would check rather than assume — if IR is fine for a few hours and the vulnerability is being actively exploited against our sector on an appliance we have exposed, that flips.

The board paper is usually the one that moves, and there is often room to renegotiate it: a shorter paper, a verbal briefing, or Monday instead of Friday. Deadlines set on the assumption of a quiet week are frequently movable when you ask.

The part that matters most is the communication. I would tell all three stakeholders what I am doing and why, rather than silently dropping one and hoping. "I am on the incident today, I have triaged the vulnerability and we are not exposed on the affected component so it can wait until tomorrow, and I need either an extra day or a shorter scope on the board paper" is a professional answer. Three people delivered to badly is worse than two delivered well and one honestly renegotiated.

If two genuinely tie in weight, that is a decision for the person who owns the priorities, and I would escalate it as a decision rather than absorbing it and burning out.