Your Team's Communication Isn't Just What You Say – It's Who You Are: Understanding Constitutive Theory

How your security and privacy teams communicate doesn't just convey information—it actively creates your organization's security culture, decision-making processes, and operational reality. 

Security and privacy leaders often view communication as a tool — a way to convey policies, report incidents, or train employees. But communication is far more fundamental than that. The way your team communicates doesn't just describe your organization's security or privacy posture; it creates it.

This is the core insight of the constitutive theory of communication, a body of scholarship that’s transformed how we understand organizations for more than two decades. For security and privacy leaders, constitutive theory offers a powerful lens for understanding why some programs thrive while others struggle, regardless of their technical investments.

Communication as Creation

Historical approaches to organizational communication view it as a conduit or container that facilitates the flow of information from sender to receiver through various channels. This "conduit metaphor" assumes that communication simply transports meaning from one place to another, implying that your team's job is to craft clear messages about policies and threats, then push them through the right channels to reach employees.

Constitutive theory fundamentally challenges this assumption. Communication as Constitutive of Organization (CCO) is the idea that an organization emerges in and is sustained and transformed by communication. Rather than viewing communication as something that happens within your organization, constitutive theory presents that communication is your organization. I’m not referring to semantic wordplay; this has profound practical implications. When your team holds a meeting, sends an alert, or conducts an incident response, you're not simply exchanging information; you're sharing insights and influencing behavior. You're essentially constructing what your organization is, how it operates, and what it values.

Communication Systems Change Behavior

The most immediate implication of constitutive theory is understanding how different communication approaches fundamentally alter organizational behavior. CCO provides leaders with new perspectives on how their organization operates – identifying who has influence, how decisions are made, and what everyone's actual role is — by paying attention to how people communicate with each other. When working with Discernible clients, we observe how each communication pattern actively shapes their individual and team roles through ongoing interactions.

Consider two security teams facing the same phishing incident:

Team A follows a traditional top-down communication approach. The CISO sends an email blast warning about the threat, IT blocks malicious domains, and security awareness schedules mandatory training sessions. Information flows from experts to employees.

Team B adopts a constitutive approach. They lead cross-functional incident response conversations that include voices from affected departments, ongoing dialogue about emerging threats rather than one-way announcements, and they recognize that every conversation shapes how the organization understands and responds to security challenges.

The difference isn't just in style, but in the organizational reality each approach creates. Team A constructs an organization where security is something done to employees by experts. Team B constructs one where security emerges through collective engagement and shared accountability. 

Each communication approach also determines how much influence and political capital your program accumulates. Team A's top-down approach positions security as a cost center that restricts business activities, which will gradually erode leadership support. Team B's collaborative approach positions security as a business partner, building the political capital necessary for budget approvals, strategic alignment, and organizational change.

Your Organization Is Your Communication Patterns

Perhaps the most radical insight of constitutive theory is that your organization doesn't have communication patterns; it is those communication patterns.

Think about what this means for incident response. When a security incident occurs, how does your team communicate? 

Do you:

• Hold meetings with predetermined hierarchies and speaking orders?
• Create ad-hoc channels for rapid information sharing across departments?
• Default to formal reporting structures that delay critical decisions?
• Enable real-time collaborative problem-solving with diverse stakeholders?

Each approach actively creates an organizational structure in the moment. CCO scholarship argues that communication itself is responsible for bringing organizations into being, and then perpetuating and transforming them. The implications extend beyond incident response. For example, every team stand-up, every policy review meeting, every board interaction is simultaneously describing and creating your organization’s reality. 

This becomes particularly visible in how your team interacts with other departments, actively building or destroying your political capital. 

Are you:

• The Department of No: Creating interactions based on restriction, compliance, and gatekeeping? This communication pattern creates adversarial relationships that drain political capital.
• Strategic Enablers: Fostering conversations focused on business objectives and risk-informed decision-making? This approach earns influence by making business objectives achievable.
• Collaborative Partners: Building ongoing dialogues that value security considerations in organizational planning? Teams using this approach accumulate political capital by making others more successful.

In constitutive theory terms, influence is something you create through repeated communication patterns. Every interaction either deposits or withdraws from your political capital account. When you consistently communicate in ways that make other teams more successful, you establish yourself as an indispensable organizational asset. Imagine if anyone on your team were seen this way by business stakeholders. 

Designing Communication Intentionally

Most security communication strategies focus on tools and channels, such as better dashboards, clearer policies, and more engaging training platforms. While these have value, constitutive theory suggests a more fundamental approach: intentionally designing the communication patterns that will constitute your desired organizational reality. Building trusted relationships with various stakeholders is crucial, but as we’ve pointed out before, we build trust through consistent communication patterns, not solely communication content. Team leaders who think like organizational architects understand that every interaction is an opportunity to shape the culture, operational processes, and stakeholder relationships that will improve your organization's resilience, agility, and reputation. 

So, instead of viewing business leaders and cross-functional partners as audiences for security messages, recognize them as co-creators in your organization's security and privacy reality. Moreover, CCO scholarship promotes a "post-heroic" understanding of management, where human impact is a result of the network of communication, rather than a lone individual. Instead of centralizing all security and privacy decisions with a small group of experts, you can create communication processes that enable distributed, informed decision-making.

Since the question isn't really whether you're shaping your organization through communication (because you inevitably are, whether you realize it or not) – the question is whether you're doing so intentionally, with awareness of how your communication choices create the culture, operational capabilities, and stakeholder relationships that determine your program's success.