You're facing a cybersecurity incident. How should you manage media inquiries effectively?

"In such situations, it’s crucial to have a designated spokesperson and a pre-approved communication plan. Transparency builds trust—acknowledge the issue, avoid speculation, and commit to regular updates. The goal is to manage perception while resolving the situation internally."

When a cyber incident hits, the media often comes knocking—and how I respond can make or break trust. Here’s my approach: 1- I Designate a Single Voice – Whether it’s me or a trained PR lead, I ensure only one credible source speaks to avoid mixed messages. 2- I Stick to Verified Facts – No speculation, no jargon—just clear, confirmed details. If I don’t know, I say, “We’re investigating.” 3- I Control the Narrative – A brief, honest statement upfront (even if details are limited) prevents rumors from spreading. 4- I Prep Q&A in Advance – Anticipating tough questions helps me respond confidently and consistently. 5- I Monitor & Correct – Tracking coverage lets me address inaccuracies quickly.

In a cybersecurity incident, handle media inquiries with extreme caution. Large organizations usually have a PR/communications team for external messaging. Before talking to the media or third parties, consult legal counsel and your cyber insurance provider to avoid liability risks. Share only verified, approved information, never speculate. Transparency is crucial, but premature or incorrect statements can worsen reputational damage, legal exposure, or regulatory consequences. A coordinated response ensures compliance and protects stakeholder trust.

During a cybersecurity incident, it's crucial to manage media inquiries with care. All communication should be handled by a designated spokesperson who provides accurate, timely, and consistent information. Avoid speculation, focus on verified facts, and reassure the public about the steps being taken to investigate and mitigate the impact. Transparency and calm communication help maintain trust and credibility.

From experience, a single, trained spokesperson minimizes mixed messages and maintains trust. This person must understand both the technical and reputational dimensions of the crisis. Ideally, they are media-trained and have participated in regular tabletop exercises with the cybersecurity team. Don’t underestimate internal communication either—employees are unofficial spokespersons too. Remind them of communication policies and update leadership in real time to maintain consistency.

When a cybersecurity incident hit us, one of our smartest moves was designating a single, trained spokesperson. They were well-briefed, calm under pressure, and knew exactly how to walk that line between transparency and confidentiality. Instead of mixed messages flying around, we had one clear voice representing the organization. That consistency helped maintain trust with the public and control the media narrative throughout the crisis.

Transparency in the initial response is absolutely critical. A clear, jargon-free acknowledgment not only maintains public trust but also demonstrates organizational maturity. It’s better to say 'we're assessing the situation' than to speculate and risk misinformation. The right tone in the first 24 hours can define the entire narrative.

Handling media inquiries during a cybersecurity incident isn’t just about communication — it’s about trust management. I believe having a pre-designated spokesperson with a verified fact-first approach is essential. Even saying 'we’re still investigating' builds more confidence than guessing. A coordinated, honest, and jargon-free communication plan not only controls the narrative, it protects the brand’s long-term credibility.

Statements should reflect both empathy and authority. I've seen organizations fall short by sounding robotic or overly legalistic. Instead, prepare tiered messaging: one for the public, one for regulators, and one for internal stakeholders. Include what you know, what you’re doing, and when you’ll share more. Avoid absolutes like “no data was accessed” unless 100% certain. Establish a cadence for updates—going dark invites speculation. Preparedness here builds public confidence.

The organizations that were most prepared to respond to a cyber security incident tended to have a clearly defined crisis communications plan and also prepared statements that can be promptly customized and provided to the public in case there needs to be an announcement about an ongoing security incident. Prepared statements save time because the organization is able to focus on the response and not lose precious cycles developing a statement from scratch.

Transparency in the initial response is absolutely critical. A clear, jargon-free acknowledgment not only maintains public trust but also demonstrates organizational maturity. It’s better to say 'we're assessing the situation' than to speculate and risk misinformation. The right tone in the first 24 hours can define the entire narrative.

In today’s media landscape, the first narrative often becomes the lasting one. Control doesn’t mean spin—it means precision and proactivity. I advise teams to use digital channels to establish their narrative quickly (e.g., a dedicated incident response page). Monitor social media chatter and correct misinformation fast. Leverage third-party endorsements where possible (e.g., external forensics firms) to add credibility. Own your story or risk others telling it for you.

Org should be well prepared for that and run various simulation just like Red team to understand what kind of impact that they would face in those event.

Don’t wait for media questions—reach out. I've seen organizations protect their brand by briefing key reporters early and offering transparency with boundaries. Offer interviews with technical and executive leadership when appropriate. If regulators or lawmakers are involved, include public affairs experts to align messaging. Remember: proactive engagement shows confidence and command, which mitigates fear and reputational harm. Use this as an opportunity to reinforce your security-first culture.

Media inquiries during a cybersecurity incident are not a priority; containment, investigation, and remediation are. That said, any communication must be controlled, factual, and routed exclusively through trained spokespersons. Speculation, emotional responses, or premature disclosures only serve to amplify chaos and damage. If you're unprepared to manage the narrative, the media will write it for you... and they won't wait for your consent :)

Once the dust settles, follow-through is where many falter. In my experience, this phase is where long-term trust is built or broken. Share lessons learned, planned improvements, and timelines. Consider publishing a post-incident report, tailored for different audiences. Update customers personally if they were impacted. Regulators will appreciate the transparency—and so will your board. Make recovery communication part of your brand’s resilience story, not a forgotten chapter.

During a cybersecurity incident, managing media inquiries effectively is crucial. Start by acknowledging the situation with a clear, brief statement. Designate a trained spokesperson to ensure consistent messaging. Prepare statements in advance to save time and maintain clarity. Control the narrative by providing regular updates and correcting misinformation promptly. Engage proactively with media contacts to keep them informed and avoid speculation. After the crisis, continue to communicate, share lessons learned, and outline steps taken to prevent future incidents, reinforcing your commitment to security and transparency.

In a cybersecurity incident, managing media inquiries requires a clear, transparent, and controlled response. Start with an immediate acknowledgment of the situation, avoiding speculation and providing verified facts. Designate a well-prepared spokesperson to maintain consistency in messaging. Craft prepared statements to save time and ensure alignment with your organization’s values. Control the narrative by offering regular updates and correcting misinformation promptly. Engage proactively with key media contacts and, after the crisis, continue communication to rebuild trust by sharing lessons learned and future safeguards.