About this module
A security crisis needs careful communication as well as technical response. This module explains who should speak internally, who should talk to media, and why support teams need approved language. Learners see how speculation, scattered updates, and public guesses can damage trust and complicate the investigation. The lesson also covers one source of truth, stakeholder updates, and message discipline. The safest communication is accurate, approved, and coordinated through the people responsible for the response.
Key takeaways
When a breach hits, what you say, and who says it, can matter as much as how fast you contain it. Three seventeen P.M., ransomware hits, and the war room lights up. What your team says in the next hour will shape this story for months to come. Crisis communication isn't a side task for the marketing team, it's a core part of incident response.
The words you choose can calm your stakeholders, or make the breach worse. Every crisis has three audiences. Internally, one executive updates all employees, so nobody hears rumors first. With media, only the C.E.O. or the C.I.S.O. speaks on the record. Customers hear pre-approved language from support, never speculation. Speculation is the enemy here.
Until your forensics team confirms the scope, resist the urge to fill in the blanks, a wrong guess costs more credibility than staying quiet ever will. Keep one source of truth. Every update lives in a single shared channel, timestamped without exception, and all media inquiries funnel through a single point of contact so nobody freelances an answer.
Here's the format we recommend for every internal update: what we know, what we're doing, what's next, and where to ask questions. Same structure every time. Consider standing up a live status page: one page, updated on a fixed schedule, that every stakeholder learns to check and trust instead of guessing.
Remember the rule of three: say what you know, say what you don't know yet, and say what happens next. That's the whole playbook. Avoid "no comment," and avoid guessing at what happened. Say instead, "we are investigating, and will update you by five P.M." Specific, honest, and time-bound.
Industry research suggests sixty percent of the reputational damage in a breach comes from a slow, inconsistent response, not from the breach itself. In the first hour, confirm the incident and alert your crisis team, then have one spokesperson brief every employee. By hour four, issue a first statement, facts only. By hour twenty-four, share a full update.
Remember four things: one voice speaks for the company, never guess, keep one source of truth, and move with speed. Practice this before a crisis hits. Know who your spokesperson is, where your single channel lives, and what your first hour looks like.
