Crisis communications for security incidents
A disciplined first response for breaches, ransomware, disclosure and correction requests.
Could we talk this week?The problem
Security incidents create pressure before every fact is known. I help leadership establish what is confirmed, who approves the message, what the first holding statement says and when the next update will come.
What I do
- First 24 hours and holding statements
- Ransomware and breach disclosure
- Correcting the record
- Crisis playbooks and rehearsal
Relevant experience
A prior Afilias response resulted in a Newsweek story being removed within 90 minutes. Source
The Microsoft case study documents incident communications work with the Trustworthy Computing team. Source
How an engagement works
I build a practical crisis communications playbook around your actual response team, approval path, audiences and known risks. I can help prepare holding statements, reporter responses, customer FAQs and executive updates. A prior Afilias response resulted in a Newsweek story being removed within 90 minutes. I do not provide legal advice or promise a publisher's decision.
The first 30 days
- Map the incident team, approval chain, audiences and escalation contacts.
- Draft holding language, FAQs and response templates for likely security scenarios.
- Run a tabletop rehearsal for the first reporter inquiry, executive update and customer question.
Questions
What happens in the first 24 hours?
I help establish the facts, owners, approval path, holding statement, reporter response and next-update cadence without speculating.
Can you help with ransomware or breach disclosure?
Yes, on communications. I work alongside security and legal leads to prepare clear, approved language and stakeholder updates.
Can you get a story corrected or removed?
I can assess the record and prepare a professional request. The publisher controls its editorial decision.
Do you provide legal advice?
No. Legal advice, disclosure decisions and clearance remain with your counsel.