For years, cybersecurity was viewed primarily as a technical challenge best left to IT departments, security operations centers, and outside consultants. Today, that perspective is outdated. In an era where trust is often an organization’s most valuable asset, a cyberattack is no longer just an IT problem, it is a reputation crisis.
When a data breach, ransomware attack, or other cyberattack occurs, stakeholders are not only evaluating the technical failure, but also the organization’s response.
Modern business audiences understand that no organization is completely immune to cyber threats. Sophisticated attacks can impact companies of any size and across any industry. What stakeholders want to know is whether leadership is prepared, accountable, and transparent when an incident occurs.
Business customers will question whether their own operations or data are at risk. Partners will want to know whether the organization can continue to fulfill its commitments. Investors may focus on management competence and long-term business implications. Employees need clarity about what happened and what it means for them.
This shows that a cybersecurity incident immediately becomes a multi-vector communications challenge.
Are You in Control?
A critical factor in any cyber crisis is whether the organization controls the initial disclosure. When a company identifies an incident first, it has an opportunity to verify facts, notify key stakeholders, and communicate from a position of preparedness. This doesn’t mean you can take your foot off the gas, as an external party could go public at any moment. Don’t squander the opportunity to control the narrative and secure a helpful story where you set the tone. More on this below.
If news of the attack emerges through the media, threat actors, customers, regulators, or social media, the timeline for response will be accelerated, but that does not mean you have to go public immediately. The first steps are to ensure that the reporting is accurate, and get necessary corrections made, as well as to reach out to your customers demonstrating they are your first priority.
Deciding When and Who
One of the most difficult moments in any cybersecurity incident occurs before all the facts are known and before the situation becomes public. Organizations must balance the need to communicate quickly with the responsibility to provide accurate information. Waiting too long can be interpreted as disorganization, not taking the incident seriously, or a cover up. Conversely, communicating too early without real knowledge can further confusion, erode credibility, or seen as a lack of competence.
There is no single answer for every situation. It is also essential to focus first on understanding the scope of the incident, identifying affected stakeholders, and determining what information can be communicated with confidence. What is most important is not to over or under communicate. Overcommunicators share assumptions or expectations that are more likely to set you up for failure when they don’t come to fruition. Stating that “We believe only 10% of our customers were impacted” when the investigation is ongoing is a death sentence when it turns out 85% were affected. On the other hand, undercommunicators who state nothing more than “We are currently investigating the cause and impact of the event” can buy you some time, but more than a few days of this will have customers up in arms.
Another key decision is the sequence of communications. Mapping out key constituencies and who needs to hear from the organization first is pivotal as regulators, key customers, elected officials, business partners, and employees all need to be considered. You may think the answer is obvious, but it rarely is. Publicly-traded companies usually don’t have the luxury of careful sequencing and have to publicly disclose a cyber-attack to all parties at once. That means a similar plan for follow-on communications to various audiences that is tailored to their specific needs is massively important. Organizations that establish clear decision-making processes for these moments are better able to communicate quickly and with confidence.
Transparency Is No Longer Optional
Organizations facing a cybersecurity crisis must be prepared to communicate early, communicate often, and communicate honestly. While that does not mean sharing every technical detail before all the facts are known, it does mean acknowledging the situation, explaining what actions are being taken, and providing regular updates as new information becomes available.
Transparency helps preserve credibility. When stakeholders are alerted that an incident has occurred, they are far less forgiving if they feel information is being withheld or when they are learning about developments from third parties rather than directly from the organization itself.
The speed of communication can significantly influence how trust is maintained or eroded throughout the lifecycle of a cybersecurity crisis.
One Message Does Not Fit Every Audience
One of the most common mistakes organizations make during a cybersecurity event is assuming that a single message will resonate with every stakeholder group. As detailed above, different audiences have different concerns and require different levels of detail.
Organizations that recognize this distinction are often better positioned to build confidence and reduce misinformation during a rapidly evolving situation.
When developing communications for stakeholders following a cyber incident, organizations must carefully consider which channels will most effectively reach and resonate with each audience. While traditional press releases and corporate statements remain important tools, they are not always the most effective means of engagement.
Online communities, including industry forums, Reddit discussions, and social media platforms, often value direct, transparent engagement over highly scripted corporate messaging. When appropriate, having knowledgeable representatives respond directly to questions and concerns can foster credibility, demonstrate accountability, and reinforce that the organization is actively addressing the situation. This authentic, two-way communication can be instrumental in rebuilding trust and shaping public perception during a cyber crisis.
Engaging the Media
While no organization wants a cybersecurity incident to become a news story, media coverage is often unavoidable. Organizations should actively monitor traditional and social media channels to understand how the event is being reported and identify inaccuracies, speculation, or misinformation that could further damage stakeholders’ trust.
At the same time, engaging with the media too early can create unnecessary risks. Before speaking publicly, organizations should have a clear understanding of what occurred, the scope of the incident, the actions being taken to contain it, and the steps being implemented to prevent a similar event from happening again.
Once the organization has fully assessed the incident and implemented corrective measures, media engagement can become an important tool in rebuilding trust. Proactive discussions with reporters can help communicate the facts of the event, the organization’s response, and the investments made to strengthen security going forward.
A well-executed follow-up story can shift the narrative from one focused solely on the breach to one centered on accountability, transparency, and the actions taken to emerge stronger following the incident. This means that, rather than responding to every inquiry, the best course of action may be to work with a carefully selected reporter to get your message out and set the tone for additional coverage.
Our Expertise
At Stanton, we have seen firsthand how effective communication can help organizations navigate complex cybersecurity challenges. Although organizations cannot always control a crisis, they can influence how it is understood and communicated to key audiences.
This is why we continuously develop and refine our crisis playbooks, ensuring we help clients respond quickly, communicate effectively, and maintain stakeholder trust during cyber incidents of any scale or severity.
Cybersecurity incidents will continue to occur. The organizations that emerge strongest will be the ones that recognize cyber crises for what they have become: trust, reputation, and leadership challenges that demand strategic communication from day one.
By Tom Faust, Managing Director and Trevor Blaisdell, Senior Account Supervisor at Stanton.