Technical Communication

A collection of 19 posts

Incident Response

Don't Let AI Write Your Public Post-Mortem

AI-generated incident post-mortems recycle the same bad patterns of poor structure, too much noise, and buried ledes. Here's why you shouldn't let AI write yours, and a better prompt for teams without communications support.

Ethics

Calling Technology Magic is Bad Communication

Consent frameworks were were designed to protect companies, not users. Lisa LeVasseur of Internet Safety Labs breaks down the tobacco playbook still running in tech, and what security and privacy leaders can do differently.

Incident Response

Trust Recovery Starts Before the Incident, Not After

Trust recovery starts before the incident. Most organizations treat customers as outsiders to protect from technical details but your incident is also happening to them. Withholding context doesn't protect you and wastes the opportunity to demonstrate competency.

Incident Response

Transparency Schmarency: Security Disclosures Should Be Honest and Helpful

The organizations building real trust do more than meet legal minimums. They also give affected users what they need to protect themselves: clear impact assessments, immediate action steps, and information that actually matches their situation.

Mailbag

📬 Mailbag: What's the best approach for sharing vulnerability findings with developers to avoid inciting defensiveness?

Vulnerability findings land differently depending on how you deliver them. Security professionals who understand framing and loss aversion can create conditions where dev teams want to fix them. Same finding, with a completely different outcome.

Organizational Communications

Sharks in Engineering Waters

Healthy organizations have disagreement and research shows engineering teams that nurture productive conflict outperform those that avoid it — better solutions & more innovation. Visible friction isn't a warning sign, but proof of psychological safety.

Incident Response

Top Communication Assets to Build Before Your Next Security Incident

Effective incident response requires proactive communication assets built in advance. Here are 5 foundational elements to streamline communications, enable nimble responses, and demonstrate your security team's ability to overcome complex challenges.

Incident Response

Introducing Discernible Experience: The Power of Persistent Practice

The Discernible Experience runs realistic communication simulations where security professionals from different organizations practice together. Same scenario, different perspectives — that's the point. You'll face challenges internal training never surfaces.

Incident Response

Maintaining Composure: Effective Emotional Regulation in Security Incident Response

The ability to remain calm and composed during an incident response is critical to a successful recovery. Written plans and procedures are great, but execution is the hardest part because human emotions can get the better of security teams and their partners across the business.

Incident Response

Empowering Business Leaders to be Savable Victims: Drawing Incident Response Insights from Rescue Scuba Diving

Discernible helps security and privacy organizations build communication capabilities and political capital before crises happen, shifting teams from reactive explainers to proactive influence-builders.

Proactive Communication

Takeaways from 2023 - and Resolutions for 2024

Here are three security communication patterns I observed the most often in 2023 and why you should resolve to address them in 2024.

Incident Response

📬 Mailbag: How do you manage/balance truthful communications about an incident/breach while mitigating legal exposure?

A reader asks: How do you manage truthful communications about an incident while mitigating legal exposure?

Guest Post Featured

“The solution is not buying another server, it’s having better communications.”

Q&A with DEF CON founder and CEO Jeff Moss on the value of security communications.

Incident Response

📬 Mailbag: Are there any examples of good incident response communications?

A reader asks: Are there any examples of good security incident communications?

Privacy Communication

Words with Impact: Communication Tips for Privacy Technologists

An interview with Discernible CEO Melanie Ensign and the Shifting Privacy Left Podcast.

Proactive Communication

Does Your Security Comms Strategy Need an Upgrade?

The best crisis communication strategy is the one you're doing when nothing's on fire. Consistent, routine security and privacy communications reduce both the frequency and impact of crises — because demonstrated care compounds before you ever need it.

Bug Bounty

Metacommunication and Bug Bounty Programs

Bug bounty programs run on async text where unspoken cues make or break researcher relationships. Effective teams focus on outcomes over winning arguments, explain decisions without defensiveness, and invest in trust to maintain productive long-term partnerships.

Incident Response

What is a Security or Privacy Incident? Hiccups, F*ck Ups, and Give Ups

Most orgs only disclose what's legally required, ignoring everyday hiccups, avoidable mistakes, and routine apathy that cause more long-term damage than major breaches. Proactive comms across low-risk, high-frequency incidents builds muscle memory before real crises hit.

Incident Response

Communication Gaps in Security and Privacy

Security and privacy teams hit avoidable crises when they only call communications pros after incidents strike. Treat communication strategy like compound interest -- invest early in relationship-building, incident prep, and resilience before you need crisis management.