The 7:15 problem
The alert lands at 7:15 on a Tuesday. By 7:40, someone in accounting has screenshotted it into a group text. By 8:20, a regional VP has reassured his three largest accounts that it’s nothing. At 9:00 your General Counsel wants to know who authorized that, and your CEO wants to know why she heard about it from a customer.
None of that is a security failure. Containment may be going fine.
What failed is that nobody decided, in advance, who speaks.
We facilitate tabletop exercises for a living, and this is reliably where the room goes quiet. Teams can walk us through how they’d isolate a host. Ask who calls the cyber insurance carrier and you get a pause, then three people looking at each other. Ask who approves the customer notice and you often get a name, followed by someone else disagreeing with that name.
The good news is that this is the most fixable part of incident response. You cannot decide today how you’ll contain an unknown attack. You can decide today who is allowed to hit send.
Nobody knows who’s allowed to hit send
Most communication delays don’t come from lawyers. They come from an org chart that has never been asked this question.
Assign it before you need it: an incident commander, an executive sponsor, a communications lead, counsel, and named business and technical representatives. Then name the alternates, because incidents don’t check the PTO calendar. We have watched an entire notification chain route through a single VP who, in the scenario, was mid-flight — and watched the room burn real minutes rebuilding a decision path that should have been on a card in a drawer.
Keep the incident commander and the communications lead as two people. Not because the roles conflict, but because the person directing containment does not have the bandwidth to write for four audiences at once. When those roles collapse into one, the result is silence — not by decision, but by overload.
Build this week: a one-page approval matrix. Audience, who drafts, who reviews, who approves, and the clock. If it runs longer than a page, it won’t get used at 7:15 on a Tuesday.
Say less, and say it on a clock
An early incident message has four jobs: what we know, what we’re doing, what you need to do, and when you’ll hear from us next.
The fourth one is the one everyone forgets, and it’s the only one that buys you patience.
The instinct under pressure is to sound like you have it handled — to smooth the edges, to project. Resist it. An internal notice that says the company is investigating suspicious activity affecting a named system, has isolated the relevant assets, and needs employees to stop restarting devices or using a specific application is worth more than a confident announcement of a “cyberattack” three hours before you know that’s what it is.
External messages need more care, not more words. Customers do not want your technical narrative. They want to know whether the service works, whether their information is involved, what you’ve done about it, and what they should do. If the investigation is ongoing, say that plainly. Don’t promise a restoration time and don’t confirm or deny data exposure until the evidence supports it.
The line that works looks like this: The investigation remains active. Containment actions continue. Our next update will be issued at 4:00 p.m. Eastern. It claims no progress. It sets an expectation. And it is a promise you can actually keep, which matters, because the update you skip is the one people remember.
Stakeholders will tolerate an investigation that takes time. They will not tolerate silence. Silence isn’t neutral — people fill it, and what they fill it with is almost always worse than the truth.
Build this week: a message log. Time, audience, channel, approved wording, owner. Every sentence you send may eventually be read by a regulator, an insurer, an auditor, opposing counsel, or your board. Consistency is protective, and you cannot be consistent from memory.
Not everyone gets the same message
Executives need decision-ready information. Employees need instructions that keep them from inventing dangerous workarounds. Customers need impact. Critical vendors need to preserve logs, suspend an integration, or help you contain.
In exercises, teams almost always start by drafting one carefully worded all-hands statement and trying to stretch it across all four. It reassures nobody and instructs nobody.
Map the audiences before the incident:
- The response team, executive leadership, counsel, and your cyber insurance contacts
- Employees, contractors, and temporary staff who need operational instructions
- Customers, partners, and vendors with affected services or data dependencies
- Regulators, law enforcement, card brands and acquirers, and anyone else with a notification right or obligation
Then get honest about channels. Email is fine for routine updates and useless during an identity compromise — worse than useless, because the attacker is reading it. A status page gives customers one consistent source. A secure collaboration space keeps the response team coordinated. Whatever you choose, your responders and executives need a way to reach each other that does not depend on the environment you’re currently investigating.
Build this week: an offline contact roster. Printed, or on a phone, or both. A contact list that lives only in the system you’ve just isolated is not a contact list.
The review trap
Legal helps you evaluate notification duties, privilege, contractual commitments, and wording risk. Privacy, compliance, HR, and business leaders each have real input depending on the event.
But requiring everyone to approve everything is how organizations arrive at silence with full consensus.
Decide in advance which messages need legal or executive review and which the incident commander or communications lead can issue on their own using pre-approved language. Operational instructions to employees rarely need a committee. Anything that characterizes cause, scope, or data exposure almost always does.
Keep templates for the scenarios you’ll actually face: service disruption, suspected unauthorized access, confirmed data exposure, credential reset instructions, employee phishing guidance, vendor escalation. Treat them as scaffolding, never as copy-and-send. Every message gets tailored to the facts. The template just means you aren’t starting from a blank page while your phone is ringing.
The confidence trap
A calm, candid leader stabilizes an incident. A confident leader who has to walk something back does the opposite, and the walk-back becomes the story.
“Was customer data stolen?” is a question you may not be able to answer for days. The disciplined response acknowledges the concern, confirms the investigation is active, describes the protective steps already taken, and commits to the next verified update. That isn’t evasion. Compare it to saying “no customer data was affected” at hour three and retracting it at hour thirty. One of those costs you a news cycle. The other costs you the relationship.
Boards deserve particular attention here, and this is where most technical updates fail. Directors need business impact, response status, decisions made and decisions pending, legal and regulatory exposure, customer impact, and recovery priorities. They do not need telemetry. The work is translation — turning security findings into risk, operational, and governance terms the board can actually act on. Executives who can do that under pressure make better decisions and get more room to make them.
You don’t have a plan. You have a document.
A communication plan that has never been exercised is a hypothesis.
Test it with the pressure points that actually break things. Your email system is compromised. A reporter is calling. A key vendor won’t produce evidence on your timeline. A major customer wants an answer today. An executive wants to post something on LinkedIn tonight, and he’s already written it.
Those injects find the gaps that a document review never will — the missing alternate, the approval nobody owns, the template that doesn’t fit the facts, the contact list that was accurate two reorganizations ago.
Then write the after-action report, with named owners and real due dates. Update the matrix. Revise the templates. Re-check what your contracts actually obligate you to say and how fast. That report is also the artifact your auditors, your insurer, and your board will ask for — evidence that lessons learned became operational changes rather than a slide.
Back to 7:15
Clear incident communication won’t make the disruption smaller. It will change what your organization does with the first two hours.
The alert still lands at 7:15. But the commander is named, the alternate is reachable, employees have instructions before they invent their own, customers hear from you before they hear from each other, and everyone knows the next update comes at four.
That’s the difference between managing an incident and being managed by one.
Skøut Advisory helps executive teams design, document, and test the plans they’ll depend on during a real event. If you’ve never run your communication plan under pressure, that’s where we’d start.