Melanie Ensign

Bug Bounty

Powerful Expectations: Effective Communications for Bug Bounty Programs

Q&A with Reginaldo Silva, security researcher and former security engineer at Facebook/Instagram

Proactive Communication

Takeaways from 2023 - and Resolutions for 2024

Here are three security communication patterns I observed the most often in 2023 and why you should resolve to address them in 2024.

Incident Response

📬 Mailbag: How do you manage/balance truthful communications about an incident/breach while mitigating legal exposure?

A reader asks: How do you manage truthful communications about an incident while mitigating legal exposure?

Incident Response

📬 Mailbag: Are there any examples of good incident response communications?

A reader asks: Are there any examples of good security incident communications?

Influence

Not Just Security: CISOs are Business Executives

New research shows effective communication strategy and execution is critical for CISOs to earn and maintain legitimacy with the business.

Privacy Communication

Words with Impact: Communication Tips for Privacy Technologists

An interview with Discernible CEO Melanie Ensign and the Shifting Privacy Left Podcast.

Incident Response

Turning Incident Response Communications into a Sustainable Security Communications Program

The best incident response communications are built on a foundation of strong, ongoing security communications. Here are a few thoughts on how to do that.

Incident Response

Communication Measurement and AI

AI makes outcomes-based measurement even more practical. Imagine tracking the real impact of specific content, language, and timing in incident response communications — not just counting outputs, but understanding what actually moved stakeholders. That capability is closer than most teams realize.

Privacy Communication

Communication Research Takes on the Myths of Privacy Compliance

Trust requires understanding, so if people don't know how their data is used, what rights they have, or how to exercise them, your privacy program isn't building trust it's simply avoiding complaints. Measure your communications and adjust until no one feels duped.

Chief of Staff

A CISO’s Guide to “Negative Megaphoning”

Negative megaphoning doesn't just damage company reputation, but also signals to security talent what it's like to work there. CISOs who ignore employer reputation make hiring harder for their team.

Incident Response

Scrub these Phrases from Your Data Breach Statements

Speed and accuracy are table stakes for incident response, but three common elements in public statements quietly undermine both — and most organizations don't catch them until the credibility damage is done.

Influence

Don’t Get Stuck in Conflict: Communication Techniques for InfoSec and Privacy Teams

Alignment isn't a prerequisite for progress. In fact, security and privacy professionals who influence engineering and product decisions don't wait for consensus — they learn to move work forward in the presence of disagreement. It's an invaluable communication skill.

Influence

Knocking on the Boardroom Door

Quarterly board presentations and executive updates check boxes. The CISOs who get resources and retain influence have solved a harder problem — not how to report on their program, but how to make their work visible in ways that actually matter.

Mailbag

📬 Mailbag: How should brands talk about security threats from abroad without sounding xenophobic?

A reader asks, “How should brands talk about security threats from abroad without sounding xenophobic?”

Proactive Communication

Words that Work: Persuasive Language for Security and Privacy Communications

Counting distribution and engagement tells you why you're busy. It doesn't tell you if your communications are working. Do you know which words actually land with your security and privacy audiences? There's only one way to find out — start measuring.

Proactive Communication

Does Your Security Comms Strategy Need an Upgrade?

The best crisis communication strategy is the one you're doing when nothing's on fire. Consistent, routine security and privacy communications reduce both the frequency and impact of crises — because demonstrated care compounds before you ever need it.

Organizational Communications

Beyond the Technical: Emotions and Negotiating in Security Leadership Roles

Discussions about emotions come up a lot in our incident preparedness and response work with clients because we’re always thinking about how different stimuli impact people’s expectations and ability to communicate effectively.

Community

Self-Inflicted Pain and Artificial Adversity in InfoSec

The popular saying “what doesn’t kill you makes you stronger” isn’t a guarantee. Traumatic or stressful situations can still destroy trust and motivation, cause irreparable damage to our health, and push people out of the profession.

Privacy Communication

If You Want a Seat at the Table, You Have to Earn It

Technical expertise gets you in the room, but it doesn't keep you there. Security and privacy professionals who earn lasting influence position themselves as business problem solvers fluent in competitive dynamics, not just compliance requirements.

Proactive Communication

Risk Communications: Recognizing Turning Points and Managing Decisions

Not communicating about security until it escalates into a crisis is a self-fulfilling prophecy. Instead, security communicators should constantly be on the lookout for critical turning points that can determine the direction of the organization’s future or cost them their reputation.

Incident Response

Third Party Security Incident Response: Communicating Even When You’re Not Exposed

Why you should communicate with stakeholders about 3rd party security incidents even if you’re not exposed.

Incident Response

Risk Communications: An Introduction

Security is about more than managing risk. It's also about helping non-experts make decisions with it. That's risk communication — and whether you've studied it or not, you're already doing it. The question is whether you're doing it well.

Privacy Communication

Privacy Outrage: How to Avoid it When You Can and Mitigate it When You Can’t

Organizations don't stumble into privacy crises — they build them. Audit every new product and feature before launch: What data are you collecting? Who gets it? What did you promise users? If you can't answer those questions clearly, neither can your customers.

Proactive Communication

This Year’s Strategic Relationships: Do You Have What You Need?

Most of us spent months planning this year's objectives. Fewer stopped to ask whose support, approval, or adoption do we actually need to get there?

Privacy Communication

The Rise of Privacy Tech: Defining the Privacy Tech Landscape 2021

Privacy tech companies blur together with generic alphabet-soup marketing that obscures what their products actually do. Standing out means understanding privacy as cross-functional, engaging the community, and solving real pain points; not just selling compliance fear.