Organizational Communications

A collection of 28 posts

Organizational Communications

You’re Allowed to Ask for Help With This

CISOs navigating incidents, scrutiny, inherited dysfunction, or burnout are often better at absorbing hard experiences than asking for the right help. The framing you use determines the support you can receive -- and naming what you're actually experiencing is the critical first step.

Incident Response

Why Are CISOs Afraid of Power?

Some CISOs struggle to build influence despite technical expertise because no one trains them in coalition-building, executive engagement, or team empowerment. The CISO role is fundamentally political, yet many security leaders lack the frameworks to develop the organizational influence it requires.

Incident Response

The Template Trap

The organizations that communicate best during incidents built for it. Pre-established relationships, clear decision authority, and pre-negotiated boundaries. Authentic responses don't happen by accident.

Chief of Staff

CISO as Super-Facilitator: Elevating Board and C-Suite Security Leadership

How do CISOs elevate board and executive security leadership instead of just reporting to them? Apply the 'super-facilitator' approach to transform your leadership team from audience into collaborators who drive organizational security strategy.

Chief of Staff

Beyond Translation: How CISOs Lead When the C-Suite Can’t Decide

When the C-suite stalls on security decisions, accountability rolls downhill while strategic direction never flows down. Learn four communication theory-based strategies that help CISOs lead effectively despite organizational ambiguity and competing priorities.

Incident Response

Trust Recovery Starts Before the Incident, Not After

Trust recovery starts before the incident. Most organizations treat customers as outsiders to protect from technical details but your incident is also happening to them. Withholding context doesn't protect you and wastes the opportunity to demonstrate competency.

Influence

Your Team's Communication Isn't Just What You Say – It's Who You Are: Understanding Constitutive Theory

Your communication constitutes your security program. The patterns your team uses shape culture, decision-making, and operational reality. Leaders who understand this build political capital faster and design programs that actually perform.

Incident Response

What Could Go Right?

"What could go wrong?" is a defensive posture that caps your influence. The security teams building real political capital ask a different question: what could go right? Reverse engineer that outcome, and incident response stops being damage control and starts being strategy.

Company Updates

Organizations Lack Sufficient Decision Frameworks to Expand Incident Response Options

The security leaders with the most options during an incident built them long before it happened using consistent, values-based decision frameworks as relationship tools. Communication strategy shapes how your organization decides, not just how it explains.

Mailbag

📬 Mailbag: What's the best approach for sharing vulnerability findings with developers to avoid inciting defensiveness?

Vulnerability findings land differently depending on how you deliver them. Security professionals who understand framing and loss aversion can create conditions where dev teams want to fix them. Same finding, with a completely different outcome.

Influence

Boost Your Team's Influence with Corporate Anthropology

Your organization has a culture and your security program either works with it or against it. Corporate anthropology gives you a framework for mapping that culture, building the right relationships, and crafting narratives that make security feel essential.

Organizational Communications

Sharks in Engineering Waters

Healthy organizations have disagreement and research shows engineering teams that nurture productive conflict outperform those that avoid it — better solutions & more innovation. Visible friction isn't a warning sign, but proof of psychological safety.

Chief of Staff

CISO Communication Playbook

Technical controls and human behavior are two sides of the same security coin. CISOs who master both domains build more resilient security programs that withstand evolving threats and organizational pressures alike.

Influence

The Myth of Shared Responsibility

The uncomfortable truth is that "shared responsibility" is a myth that allows organizations to talk about security without making consequential changes to incentives and accountability structures.

Case Study

CUSTOMER CASE STUDY: Cisco Secure

Discernible was brought in to provide strategic communications analysis, training, and professional development for Cisco Secure’s then new and expanding leadership team.

Guest Post Featured

“The solution is not buying another server, it’s having better communications.”

Q&A with DEF CON founder and CEO Jeff Moss on the value of security communications.

Case Study

CUSTOMER CASE STUDY: Twilio

Discernible was brought in by Twilio’s CISO to design a creative and easily deployable solution to entice people from across the security organization to speak, blog, and generally share the good work the teams were doing and engage more deeply with their cohort outside the company.

Guest Post

A CISOs right hand on how security communications can build credibility across the organization

Jessica Walters is Senior Security & IT Program Manager at Tessian, and former Chief of Staff to the CISO of Cisco’s Security Business Group. In this Q&A, she shares her perspective on how to use security communications proactively in building an effective security team.

Guest Post

How Security Communications Gives Recruiting an Edge

Lauren Bryant has worked as a senior technical recruiter at Uber, Paypal, Lime, and more. Here, she discusses the critical relationship between recruiting and communications teams when it comes to hiring the best and brightest in cybersecurity and technology today.

Influence

Not Just Security: CISOs are Business Executives

New research shows effective communication strategy and execution is critical for CISOs to earn and maintain legitimacy with the business.

Chief of Staff

A CISO’s Guide to “Negative Megaphoning”

Negative megaphoning doesn't just damage company reputation, but also signals to security talent what it's like to work there. CISOs who ignore employer reputation make hiring harder for their team.

Organizational Communications

Beyond the Technical: Emotions and Negotiating in Security Leadership Roles

Discussions about emotions come up a lot in our incident preparedness and response work with clients because we’re always thinking about how different stimuli impact people’s expectations and ability to communicate effectively.

Proactive Communication

Risk Communications: Recognizing Turning Points and Managing Decisions

Not communicating about security until it escalates into a crisis is a self-fulfilling prophecy. Instead, security communicators should constantly be on the lookout for critical turning points that can determine the direction of the organization’s future or cost them their reputation.

Proactive Communication

Exercising Influence as the Security Team: Look for Friction Not Just Fuel

Sometimes in security, we try to win people over by pushing harder, missing the friction that prevents them from exercising the behavior or decisions we need.

Proactive Communication

The Communication Theory of Resilience: 5 Tips for Security & Privacy Organizations

The Communication Theory of Resilience gives security and privacy teams strategies to build collective strength through communication instead of individual grit. Forward-looking orgs develop these processes before crises hit, because building infrastructure during incidents is always harder.