Incident Response
AI-generated incident post-mortems recycle the same bad patterns of poor structure, too much noise, and buried ledes. Here's why you shouldn't let AI write yours, and a better prompt for teams without communications support.
Bug Bounty
Even technically brilliant researchers undermine bug bounty success through communication missteps that create adversarial relationships. Here are three common patterns that damage disclosure outcomes and how to avoid them.
Chief of Staff
Security teams that hand business leaders undifferentiated wishlists are offloading prioritization to people less equipped to do it. This post breaks down why these lists fail, what a real recommendation requires, and how reactive security comms holds organizations back.
Organizational Communications
CISOs navigating incidents, scrutiny, inherited dysfunction, or burnout are often better at absorbing hard experiences than asking for the right help. The framing you use determines the support you can receive -- and naming what you're actually experiencing is the critical first step.
Mailbag
Authenticity in security comms isn't about perfect words, but consistent patterns over time. Only communicating when legally required gives stakeholders no baseline for trust. Credibility during incidents is earned through regular communication during normal operations.
Incident Response
Effective IR comms is built through consistent low-level stress exposure before crises arrive. The same neurological principle that makes experienced cave divers capable under pressure applies directly to security teams. Use small incidents to move the threshold.
Discernible Experience
Horror fans showed greater psychological resilience during COVID because they practiced emotional regulation through scary scenarios. Security teams can apply the same principle -- frequent, varied incident comms drills build resilience by simulating crises in psychologically safe environments.
Privacy Communication
No one hands privacy professionals a roadmap for building business influence, but the research and frameworks exist. This starter kit offers curated resources on negotiation, persuasion, and coalition-building -- the skills that turn privacy expertise into business outcomes.
Incident Response
Some CISOs struggle to build influence despite technical expertise because no one trains them in coalition-building, executive engagement, or team empowerment. The CISO role is fundamentally political, yet many security leaders lack the frameworks to develop the organizational influence it requires.
Influence
3:43 PMClaude responded: You've learned to speak the business language.You've learned to speak the business language, but your concerns still get deprioritized. The problem could be the structure of who gets heard. Muted group theory explains why, and what to do about it.
Ethics
Consent frameworks were were designed to protect companies, not users. Lisa LeVasseur of Internet Safety Labs breaks down the tobacco playbook still running in tech, and what security and privacy leaders can do differently.
Influence
Most security teams mistake messaging for communication strategy. The difference shows up when your polished deck doesn't move budget, your template doesn't preserve trust, and your awareness campaign doesn't change behavior. Words are not a strategy.