Incident Response

A collection of 45 posts

Incident Response

Trust Has No Release Date

Security teams can handle an incident well and still look like they failed. Why many IR comms plans backfire and what to do instead.

Incident Response

Packing for Snakes

Most security incidents don’t have to become crises, but organizations that walk in unprepared turn routine events like bug bounty reports into emergencies. This post explains why readiness built into everyday operations keeps incidents from escalating.

Incident Response

Web3 Was the Drill: Now Everyone Needs Incident Comms at AI Speed

AI has pushed time to exploit below zero. Web3 security teams have handled incidents at this speed for years. Here’s what IR comms plans can learn from them.

Incident Response

The Sawtooth Problem

Why the before/during/after incident communication model is broken, and what it looks like to treat security incidents as moments in an ongoing stakeholder relationship instead.

Incident Response

Noindexing Your Incident Page Is a Self-Pwn

Hiding your breach notice from search doesn't hide the breach, just your version of it. Why noindexing incident pages backfires and what to do instead.

Incident Response

Objectives Before Rhetoric

Messages are tools and the potential impact of your communications is directly tied to how well you define what the message needs to accomplish.

Incident Response

Don't Let AI Write Your Public Post-Mortem

AI-generated incident post-mortems recycle the same bad patterns of poor structure, too much noise, and buried ledes. Here's why you shouldn't let AI write yours, and a better prompt for teams without communications support.

Mailbag

📬 Mailbag: We know people don't believe us when we say security is our top priority. How can we be more authentic in our communications?

Authenticity in security comms isn't about perfect words, but consistent patterns over time. Only communicating when legally required gives stakeholders no baseline for trust. Credibility during incidents is earned through regular communication during normal operations.

Incident Response

The Threshold Moves With Practice

Effective IR comms is built through consistent low-level stress exposure before crises arrive. The same neurological principle that makes experienced cave divers capable under pressure applies directly to security teams. Use small incidents to move the threshold.

Discernible Experience

Embracing Morbid Curiosity: What Horror Fans Can Teach Us About Incident Response

Horror fans showed greater psychological resilience during COVID because they practiced emotional regulation through scary scenarios. Security teams can apply the same principle -- frequent, varied incident comms drills build resilience by simulating crises in psychologically safe environments.

Incident Response

Why Are CISOs Afraid of Power?

Some CISOs struggle to build influence despite technical expertise because no one trains them in coalition-building, executive engagement, or team empowerment. The CISO role is fundamentally political, yet many security leaders lack the frameworks to develop the organizational influence it requires.

Incident Response

Why Your Incident Response Should Be Unique

Same incident. Three teams. Three completely different — and equally valid — communication strategies. That's not a bug in how we teach incident response. It's the whole lesson. Templates fail because they assume you're someone else.

Incident Response

The Template Trap

The organizations that communicate best during incidents built for it. Pre-established relationships, clear decision authority, and pre-negotiated boundaries. Authentic responses don't happen by accident.

Incident Response

When Ransomware Groups Target Executives: Lessons from Our Latest IR Scenario

Ransomware hits different when executives are personally targeted. One Discernible Experience scenario pushed participants to practice three overlooked skills: advocating for specificity over legal vagueness, sharing threat intel with competitors, and supporting leaders under pressure.

Incident Response

Trust Recovery Starts Before the Incident, Not After

Trust recovery starts before the incident. Most organizations treat customers as outsiders to protect from technical details but your incident is also happening to them. Withholding context doesn't protect you and wastes the opportunity to demonstrate competency.

Incident Response

How Organizations Sabotage Media Relations by Misunderstanding Security Communications

Security communications is more than media relations, but most organizations stop there. Journalists covering your incident are drawing on months of accumulated context including your customer support, executive messaging, and transparency record. All of it counts.

Incident Response

Transparency Schmarency: Security Disclosures Should Be Honest and Helpful

The organizations building real trust do more than meet legal minimums. They also give affected users what they need to protect themselves: clear impact assessments, immediate action steps, and information that actually matches their situation.

Incident Response

Four Ways Exceptional Incident Response Creates Competitive Advantage

Incidents handled well create advantage. Four insights from a recent Discernible Experience drill on what separates organizations that earn trust under pressure from those that just survive it.

Incident Response

What Could Go Right?

"What could go wrong?" is a defensive posture that caps your influence. The security teams building real political capital ask a different question: what could go right? Reverse engineer that outcome, and incident response stops being damage control and starts being strategy.

Company Updates

Organizations Lack Sufficient Decision Frameworks to Expand Incident Response Options

The security leaders with the most options during an incident built them long before it happened using consistent, values-based decision frameworks as relationship tools. Communication strategy shapes how your organization decides, not just how it explains.

Incident Response

Decisive Under Fire

Why do decision frameworks outperform templates for managing security incident communications? Because they empower internal stakeholders with the right expertise to make critical communication decisions under pressure.

Privacy Communication

Beyond Breach Response

Privacy incidents usually start with misalignment long before a breach. A Discernible Experience drill on privacy incident response explored how much damage happens when security, legal, and product aren't on the same page from the get go.

Incident Response

Top Communication Assets to Build Before Your Next Security Incident

Effective incident response requires proactive communication assets built in advance. Here are 5 foundational elements to streamline communications, enable nimble responses, and demonstrate your security team's ability to overcome complex challenges.

Incident Response

Introducing Discernible Experience: The Power of Persistent Practice

The Discernible Experience runs realistic communication simulations where security professionals from different organizations practice together. Same scenario, different perspectives — that's the point. You'll face challenges internal training never surfaces.

Ethics

How Data Ethics Makes Incident Response More Effective

Strong ethical data practices can enhance an organization's ability to respond effectively to security and privacy incidents.