When a cyber-attack hits, the technical fix is only half the battle. What you say, to whom and when can determine whether your organization emerges with its reputation intact or makes a bad situation worse.
In this episode, Infosecurity speaks with Ashley Sweetman, director of cybersecurity at a London-based global bank, about how to get crisis communication right (6.53). Ashley is the co-author, of Communicating Cyber Risk: Build Cyber Resilience Through Compelling Communication.
Drawing on the book's insights, he talks through the do's and don'ts of communicating after a cyber-attack. He also explains how to tailor your message for senior leadership, staff, authorities and regulators, customers and the general public.
Ashley shares real-world cases that demonstrate what to do and what to avoid when the pressure is on. Whether you're a security leader, a comms professional, or someone who hopes never to need an incident playbook, this conversation offers practical lessons for the day it all goes wrong.
Resources:
- Communicating Cyber Risk: Build Cyber Resilience Through Compelling Communication, Nina Paine, Ashley Sweetman, KoganPage
- Incident Management: How to Ensure Your Organization Can Handle a Crisis – Infosecurity Magazine
- Responding to a cyber-attack, why crisis communication matters – Infosecurity Europe
- Where to Report a Cyber Incident – UK Government
- Incident management: Helping to reduce the harm from cyber security incidents in the UK – UK National Cyber Security Centre
- Handling media attention after a major incident (last update: June 1, 2026) – UK Government
- Incident Response - Computer Security Resource Center, US National Institute of Technology and Standards
- Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (NIST SP 800-61 Rev. 3 – last update: April 2025) – US National Institute of Technology and Standards
