Incident Response

Don't Let AI Write Your Public Post-Mortem

AI-generated incident post-mortems recycle the same bad patterns of poor structure, too much noise, and buried ledes. Here's why you shouldn't let AI write yours, and a better prompt for teams without communications support.

Bug Bounty

3 Counterproductive Communication Patterns Holding Back Security Researchers

Even technically brilliant researchers undermine bug bounty success through communication missteps that create adversarial relationships. Here are three common patterns that damage disclosure outcomes and how to avoid them.

Chief of Staff

A Wishlist Is Not a Recommendation

Security teams that hand business leaders undifferentiated wishlists are offloading prioritization to people less equipped to do it. This post breaks down why these lists fail, what a real recommendation requires, and how reactive security comms holds organizations back.

Organizational Communications

You’re Allowed to Ask for Help With This

CISOs navigating incidents, scrutiny, inherited dysfunction, or burnout are often better at absorbing hard experiences than asking for the right help. The framing you use determines the support you can receive -- and naming what you're actually experiencing is the critical first step.

Mailbag

📬 Mailbag: We know people don't believe us when we say security is our top priority. How can we be more authentic in our communications?

Authenticity in security comms isn't about perfect words, but consistent patterns over time. Only communicating when legally required gives stakeholders no baseline for trust. Credibility during incidents is earned through regular communication during normal operations.

Incident Response

The Threshold Moves With Practice

Effective IR comms is built through consistent low-level stress exposure before crises arrive. The same neurological principle that makes experienced cave divers capable under pressure applies directly to security teams. Use small incidents to move the threshold.

Discernible Experience

Embracing Morbid Curiosity: What Horror Fans Can Teach Us About Incident Response

Horror fans showed greater psychological resilience during COVID because they practiced emotional regulation through scary scenarios. Security teams can apply the same principle -- frequent, varied incident comms drills build resilience by simulating crises in psychologically safe environments.

Privacy Communication

The Privacy Professional's Influence Starter Kit

No one hands privacy professionals a roadmap for building business influence, but the research and frameworks exist. This starter kit offers curated resources on negotiation, persuasion, and coalition-building -- the skills that turn privacy expertise into business outcomes.

Incident Response

Why Are CISOs Afraid of Power?

Some CISOs struggle to build influence despite technical expertise because no one trains them in coalition-building, executive engagement, or team empowerment. The CISO role is fundamentally political, yet many security leaders lack the frameworks to develop the organizational influence it requires.

Influence

Why Security Communication Feels So Hard (And What to Do About It)

3:43 PMClaude responded: You've learned to speak the business language.You've learned to speak the business language, but your concerns still get deprioritized. The problem could be the structure of who gets heard. Muted group theory explains why, and what to do about it.

Ethics

Calling Technology Magic is Bad Communication

Consent frameworks were were designed to protect companies, not users. Lisa LeVasseur of Internet Safety Labs breaks down the tobacco playbook still running in tech, and what security and privacy leaders can do differently.

Influence

Messaging != Communication

Most security teams mistake messaging for communication strategy. The difference shows up when your polished deck doesn't move budget, your template doesn't preserve trust, and your awareness campaign doesn't change behavior. Words are not a strategy.

Incident Response

Why Your Incident Response Should Be Unique

Same incident. Three teams. Three completely different — and equally valid — communication strategies. That's not a bug in how we teach incident response. It's the whole lesson. Templates fail because they assume you're someone else.

Incident Response

The Template Trap

The organizations that communicate best during incidents built for it. Pre-established relationships, clear decision authority, and pre-negotiated boundaries. Authentic responses don't happen by accident.

Chief of Staff

CISO as Super-Facilitator: Elevating Board and C-Suite Security Leadership

How do CISOs elevate board and executive security leadership instead of just reporting to them? Apply the 'super-facilitator' approach to transform your leadership team from audience into collaborators who drive organizational security strategy.

Incident Response

When Ransomware Groups Target Executives: Lessons from Our Latest IR Scenario

Ransomware hits different when executives are personally targeted. One Discernible Experience scenario pushed participants to practice three overlooked skills: advocating for specificity over legal vagueness, sharing threat intel with competitors, and supporting leaders under pressure.

Chief of Staff

Beyond Translation: How CISOs Lead When the C-Suite Can’t Decide

When the C-suite stalls on security decisions, accountability rolls downhill while strategic direction never flows down. Learn four communication theory-based strategies that help CISOs lead effectively despite organizational ambiguity and competing priorities.

Privacy Communication

How to Market Privacy Without Falling Into the Privacy Washing Trap

Consumers have gotten good at spotting privacy washing. "Your privacy is important to us" doesn't land anymore. The brands building real credibility aren't making bigger promises — they're showing their work.

Influence

The CISO's Guide to Making the Business Case: How Security Investments Drive Brand Performance

The 2025 Edelman Trust Barometer: brand trust now beats institutional trust by 13 points, and 84% of consumers rank trust alongside cost and quality. That's a CISO's business case for why security investment drives revenue.

Privacy Communication

Privacy Needs a Better Story

Privacy teams that lead with risk reduction and compliance are writing their own cost center narrative. Porter's value chain and communication framing theory offer a different approach: connect your work to operational efficiency, customer engagement, and competitive advantage.

Incident Response

Trust Recovery Starts Before the Incident, Not After

Trust recovery starts before the incident. Most organizations treat customers as outsiders to protect from technical details but your incident is also happening to them. Withholding context doesn't protect you and wastes the opportunity to demonstrate competency.

Influence

Your Team's Communication Isn't Just What You Say – It's Who You Are: Understanding Constitutive Theory

Your communication constitutes your security program. The patterns your team uses shape culture, decision-making, and operational reality. Leaders who understand this build political capital faster and design programs that actually perform.

Incident Response

How Organizations Sabotage Media Relations by Misunderstanding Security Communications

Security communications is more than media relations, but most organizations stop there. Journalists covering your incident are drawing on months of accumulated context including your customer support, executive messaging, and transparency record. All of it counts.

Incident Response

Transparency Schmarency: Security Disclosures Should Be Honest and Helpful

The organizations building real trust do more than meet legal minimums. They also give affected users what they need to protect themselves: clear impact assessments, immediate action steps, and information that actually matches their situation.

Influence

Why Effective Security Communication Starts with Strategy, Not Translations

Converting technical jargon into business language is just the first step and doesn't drive decisions alone. Effective security communication starts with the outcome you need and works backward through what your audience believes, assumes, and has experienced.