BankInfoSecurity has published a piece squarely aimed at the people who pick up the phone when a breach hits: how to keep cyber crisis communications from going wrong.

The subject lands at a moment when the margin for error in breach disclosure keeps shrinking. Regulators want notifications faster. Journalists want answers before the incident response team has finished triage. And the comms lead — often an agency practitioner parachuted into a war room at midnight — has to speak publicly about facts that are still moving.

That gap between what is known and what must be said is where crisis communications break. The piece's core premise is simple: the failures are rarely exotic. They stem from unprepared spokespersons, inconsistent messaging across channels, statements that outrun the verified facts, and organizations that go quiet once the first press cycle passes.

For practitioners, the implications are familiar but worth restating.

Prepare before the incident. Crisis templates written during an active intrusion are written under duress. Holding statements, escalation trees and pre-approved language have to exist beforehand — and someone has to have tested them.

Coordinate with the technical side. Legal, IR and comms teams frequently work from different clocks. If the forensics team hasn't confirmed data exfiltration, the press statement cannot imply it has — or imply it hasn't. Precision matters more than reassurance.

Keep one voice. Multiple spokespeople delivering subtly different accounts is a self-inflicted wound. Every subsequent discrepancy becomes a story in itself, displacing whatever containment message the organization was trying to land.

Say what you know, flag what you don't. Audiences forgive "we don't yet know" far more readily than they forgive a confident claim walked back a week later.

The stakes for agencies are direct. Breach response has become a recurring revenue line for many firms, and clients increasingly audit crisis capabilities before signing retainers — not after the ransom note arrives. A practitioner who can demonstrate a rehearsed cyber playbook, aligned with the client's legal and regulatory notification obligations, is billable in a way that generic crisis expertise no longer is.

The full piece is worth a read for anyone whose next assignment may start with a call from a CISO rather than a CMO.