Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines.
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Incidents with truly terrible user notifications are far too common.
This week's Discernible Experience scenario puts you in the seat of a Security Engineer who knows exactly what users need to know — and has no formal authority to make sure they get that information. Sound familiar?
You'll practice:
→ Articulating what "good" looks like in incident communications (not just what's wrong)
→ Mapping the organizational conditions that sideline security during notification
→ Designing the pre-incident structures that get security's voice into the process before it's too late
The best time to build communication influence is before you need it.
Subscribe at DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Security pros are quick to criticize how other organizations communicate about an incident even when they don’t know how to influence what their own organization says by doing the work that makes a good statement possible.
What happens when you have eight hours, incomplete evidence, and a reporter who may or may not have accurate information? The security team’s job isn’t to spin it. It’s to tell leadership exactly what you found, what you can’t determine, and why — so someone else can make an informed decision about what to say.
That distinction is harder to execute than it sounds.
New live scenario this Wednesday for subscribers. discernibleinc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
This week's Discernible Experience simulation follows a Web3 governance incident where the protocol worked exactly as designed.
A $40M insurance fund was drained through a legitimate governance vote, meaning there was no hack, no exploit; but nobody read the proposal so they missed the clause buried inside.
Your job is to communicate to a decentralized community when you have no email list, limited authority, and an on-chain record that's already public.
Subscribe to join at DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
This week's Discernible Experience scenario is built around a question most security teams can't honestly answer until they're already in trouble:
→ What communication infrastructure do you actually have with your vendors' security teams?
Not their account manager or general support line. A named contact, a contractual notification obligation, and a pre-agreed escalation path.
We created a new insider threat simulation to walk through:
→ Sequencing internal disclosures
→ Making the first call to a vendor's security team
→ Deciding what to tell your own customers when you don't have forensic visibility of the vendor's network
Most of what makes this scenario hard (like most real incidents) is preventable and we'll practice what to do about that.
Join us to practice!
Subscribe at DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Our newest Discernible Experience simulation is inspired by the chaotic incident with edtech vendor Canvas.
On Wednesday, our subscribers will get to practice a few things:
1) separating confirmed facts from unconfirmed ones
2) determining what your institution actually owns in a third-party breach
3) communicating honestly & credibly before you have all the answers
Subscribe to join: DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
🎉 It’a time for another Discernible Experience mini challenge!
A former employee posted a thread on Reddit claiming your company covered up a breach last year. The post is light on specifics but heavy on implication, and it’s starting to circulate. Three beat reporters have already sent inquiries. Internally, your organization is rattled, and some employees are asking if there’s something to the rumors.
The challenge: Engaging publicly might amplify a false narrative, while staying silent looks like confirmation and you need to address your own team before they start answering questions themselves.
What’s your response strategy, and in what order do you address the audiences who are watching?
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Reminder: there's no Discernible Experience this week. All other Discernible services will still be available.
We'll see you on May 13 for a brand new outage scenario.
If you're not yet subscribed to our weekly incident comms community sessions, you can join here: DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
ICYMI — CEO @Wednesday@defcon.social’s latest blog post explores how consistent, low-level stress exposure improves effective incident response and why the goal isn't simply to survive big incidents, but to use the smaller ones to move your organization’s threshold.
Read it here: https://discernibleinc.com/blog/the-threshold-moves-with-practice
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Many bug bounty programs are built on the assumption that researchers understand their findings.
AI-assisted security research has changed that with tools that scan APIs, identify behavioral patterns, and generate vulnerability chains even for researchers who may not have the technical depth to verify, reproduce, or defend what the tool surfaces. The finding can be real and the report can still be broken.
This creates a new set of communication problem that most programs haven’t considered.
Our latest Discernible Experience scenario asks participants to work through a few tough questions:
1) How do you engage a researcher who found something real but can’t explain it?
2) What does a researcher become entitled to know when their submission intersects with an active investigation?
These tensions happen all the time now.
Subscribe to join: https://discernibleinc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Psychologist Coltan Scrivner found that people who regularly watched scary movies showed greater psychological resilience during COVID-19. Why? They'd practiced emotional regulation through controlled exposure to fictional threats.
We applied this research when designing Discernible Experience: short weekly drills with industry peers, different scenarios every time, and psychologically safe while still genuinely challenging.
Read the full post: https://discernibleinc.com/blog/embracing-morbid-curiosity-what-horror-fans-can-teach-us-about-incident-response
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
New scenario drops this Wednesday!
On March 31, two malicious versions of Axios were live on npm for approximately three hours. They deployed a cross-platform remote, self-destructing access trojan through a post-install hook.
Most organizations running builds during that window will never know with certainty whether they were affected.
That is the scenario we'll explore this week to practice:
— How to do executive briefings when scope isn't confirmed
— How to communicate with engineers who already know more than you've told them
— How to make a notification recommendation before you have all the answers
Wednesday, April 22 · 12–1pm ET
Subscribe to join → DiscernibleInc.com/Experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Your containment worked & now senior leaders are asking what it’ll cost to make sure this doesn’t happen again.
This is a communication challenge as much as a technical one — and most security engineers have never been given the opportunity to practice it.
In our newest Discernible Experience scenario this week, we’ll practice communication tasks in a ransomware incident, from first alert to post-incident investment asks.
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
🎉 It’s time for another Discernible Experience mini challenge!
Your application security team discovers that a feature shipped six weeks ago logs full request payloads, including fields that contain passwords and session tokens, to a third-party observability platform. The feature is live in production. The logs have been sitting there for 42 days.
The challenge: Engineering wants to quietly fix it and move on. Legal wants to assess notification obligations. You need to get everyone aligned on a path without letting the conversation drag while the logs keep accumulating.
What’s your communication strategy for the next 24 hours — internally and potentially externally?
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Join our newest Discernible Experience this week to practice navigating a children's app privacy incident — communicating under legal exposure and briefing executives before the full scope is known.
If you work in privacy or incident response, this one is worth your time.
Subscribe to join our weekly scenarios at DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Another new Discernible Experience drops this week!
This one is a third-party incident. Your vendor’s systems were compromised, but the people whose data was taken are your customers’ employees — and they’ve never heard of your vendor.
That gap between who caused the problem and who owns the response is where several interesting communication decisions live.
Participants get to practice what it actually means to own the relationship when things go wrong outside your walls.
DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Discernible Experience is off this week for the Minorities in Cybersecurity Conference. Our next scenario will be a new supply chain incident on April 1.
See you then!
If you’re not already subscribed to our weekly simulations, you can join at DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
🎉 It’s time for another Discernible Experience mini challenge!
At 2 AM, an automated alert fires, telling you a rounding error in your protocol’s smart contract logic is being exploited in a loop. By the time your on-call engineer confirms it’s real, $4.2M in user funds has been drained. The attacker’s wallet is public on-chain, and so is every transaction.
The challenge: Your community lives on Discord and Twitter, they’re already awake, and they’re watching the blockchain in real-time. You can’t outpace the information — you can only decide how to show up in it.
What do you say, to whom, and when?
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Most security leaders haven’t practiced communicating during an incident where the technical record is already public before your internal response is organized — so we use simulated web3 incidents as opportunities to practice!
Our newest Discernible Experience scenario this week puts participants in that exact situation, working through how to brief executives, align client-facing teams, and coordinate with an unresponsive vendor when the facts are still developing.
Subscribe to participate: DiscernibleInc.com/Experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
🎉 It’s time for another Discernible Experience mini challenge!
A security researcher emails you directly — not through your bug bounty portal — claiming they found a critical authentication bypass in your production API. They say they’ve already written a draft blog post and will publish in 48 hours unless they hear back from “someone who actually has authority.”
The challenge: You don’t know if this person is a legitimate researcher, an extortionist, or someone who already exploited the vulnerability. How you respond in the next two hours sets the tone for the entire relationship.
What’s your first move — and who do you loop in before you reply?
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
FYI — Discernible Experience is off this week. Our next scenario will be a new web3 incident on March 18.
See you then!
If you’re not already subscribed to our weekly simulations, you can join at DiscernibleInc.com/Experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
One of the hardest challenges in incident response is vendor accountability.
When the root cause is outside your control but you still own the customer impact, you face a specific set of tensions that tabletop exercises rarely address:
• How do you communicate ownership without shifting blame?
• When your customers are technically literate enough to know when you're hedging, what does honest look like?
• How do an organization's engineering and legal instincts pull in opposite directions — and how do you resolve that in real-time?
• What does credible recovery communication look like after a pattern of failure, not just a single incident?
This week's Discernible Experience was built around these challenges to practice drafting internal situation briefs, navigating cross-functional disagreements about transparency, and developing key messages that resonate with a technically sophisticated customer base.
Discernible Experiences are weekly, 60-minute scenario-based simulations for security professionals to give you communication practice grounded in our real incident experience. Starting at $12.50/drill.
Subscribe at DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
In this week’s brand new Discernible Experience we’ll practice critical communication decisions during an active insider threat investigation, including:
→ Who needs to know, and who knowing too early would blow the entire investigation?
→ How do you manage normal organizational processes (like an exec asking questions) without lying, tipping off the subject, or impacting the investigation?
→ When law enforcement tells you to hold, how do you brief executives without triggering action (& should you always hold)?
These skills are almost never practiced before the moment they’re needed. So, we built this scenario for security practitioners who want to get sharpen their organizational and communication discipline.
Subscribe to join our weekly Experience: DiscernibleInc.com/Experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Most incident response training focuses on what to do technically. But what happens when the incident itself undermines your credibility to lead the response?
This week’s Discernible Experience explores a scenario many security professionals dread: managing stakeholder communication when your own expertise is being questioned during an active incident.
We’ll practice:
→ Coordinating response when you have expertise but not final authority over customer communications, legal strategy, or business decisions
→ Calibrating technical transparency — deciding what details help stakeholders protect themselves vs. what creates additional risk
→ Protecting credibility when the incident itself makes people question whether they should listen to your guidance
→ Influencing incident response decisions across legal, executive, and customer-facing teams with competing priorities and timelines
Subscribe to join this week: DiscernibleInc.com/Experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
💡 The hardest part of coordinating a vulnerability disclosure isn't the technical fix; it's navigating the people.
In our new Discernible Experience this week you'll practice key communication skills in a bug bounty context:
→ Negotiating timelines without dismissing security community norms
→ Aligning engineering, legal, and customer success on competing priorities
→ Managing researcher relationships when you need their cooperation
You'll rotate through three roles: triage engineer, bug bounty PM, and CISO -- same incident, different communication challenges at each level.
Subscribe to join our weekly sessions: https://discernibleinc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
When you’re legally allowed to stay quiet about a security incident… should you?
No regulatory triggers or legal requirements. Just a room full of executives with competing priorities.
In our new Discernible Experince this week, subscribers will practice building decision frameworks for voluntary disclosure.
Perfect for: Security engineers, incident commanders, CISOs, privacy professionals, or anyone who needs to make high-stakes communication decisions without clear regulatory guardrails.
Ready to practice making the hard calls?
Subscribe to get this simulation + a new scenario every week: DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
This week's new Discernible Experience tackles how to coordinate incident response communications when different customer segments have completely different needs, exposure, and risk tolerance for downtime?
We'll practice:
✅ Segment-specific messaging
✅ Aligning internal teams on what gets send when under pressure
Subscribe to join our weekly scenarios at: DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
We've written extensively about how companies fumble bug bounty communications. But researchers have communication patterns that undermine their own effectiveness too -- and we're seeing the same three mistakes repeatedly sabotage otherwise brilliant technical work.
Check out this new post from CEO @Wednesday@defcon.social about the researcher side of disclosure 👇
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
💫 New Discernible Experience!
OpenAI announced ChatGPT can now analyze health data and track symptoms. Users are already sharing mental health struggles and personal health information with the AI.
However, ChatGPT has weaker privacy protections than your doctor’s office.
This week’s Discernible Experience simulation explores the communication challenges when consumer health AI tools face a privacy breach.
Inspired by privacy advocates’ concerns about ChatGPT’s health features and the regulatory gray zone where AI health tools operate.
Subscribe to join: https://discernibleinc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Your supplier just compromised millions of your users.
The technical fix is straightforward, but the communication challenge is not.
How do you explain to customers that your supplier became malicious without looking like you’re making excuses?
Our newest Discernible Experience practices the stakeholder coordination and multi-audience communication skills that turn supply chain incidents into demonstrations of operational maturity.
1 hour + real pressure = practical skills
Subscribe to Discernible Experience to join our weekly simulations: https://discernibleinc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
New Mini Discernible Experience!
A critical security vulnerability is discovered during a routine system audit, but team members disagree on the severity and immediate reporting requirements.
💫 Communication Challenge: How would you facilitate a constructive team discussion to reach consensus on the incident's impact and next steps without creating internal friction?
#SecurityCommunications #IncidentResponse
If you like thinking through communication challenges like these, subscribe to our weekly Discernible Experience and sharpen your strategic comms skills.
DiscernibleInc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Security professionals are constantly trying to translate technical concepts into business language, yet critical concerns still get deprioritized. Muted Group Theory explains why this happens and reveals strategic communication approaches that go beyond better translation.
(Remember, influence isn’t just about adding more fuel, but removing friction.)
New blog post from CEO @Wednesday@defcon.social 👇
https://discernibleinc.com/blog/why-security-communication-feels-so-hard-and-what-to-do-about-it
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Your AI service provider has a critical vulnerability that's exposing customer conversation snippets across different client platforms.
💫 Communication Challenge: How would you approach customer communications when the root cause is a third-party service you've integrated?
#DiscernibleExperience #IncidentResponse #SecurityCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
🎉 New Discernible Experience launching this week!
Healthcare Insider Threat: When Curiosity Breaches Trust Wednesday, December 10 | 12-1pm ET
This new simulation is based on a real Harris Health incident where an employee improperly accessed patient records for over 10 years before being discovered. The FBI investigation required a 4-year notification delay, creating one of healthcare's most complex communication challenges.
You'll practice drafting real incident communications:
→ Coordinating with law enforcement when investigations conflict with regulatory deadlines
→ Explaining notification delays to affected patients
→ Creating clinical staff talking points
This is our final Discernible Experience for 2025 -- we'll be back in January with brand new scenarios!
Subscribe for a new experience every week: https://discernibleinc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
A ransomware attack has completely halted production across 12 manufacturing facilities in different countries, costing $20 million per day.
💫 Communication Challenge: How would you coordinate communication across multiple time zones, languages, and regulatory environments during this crisis?
#DiscernibleExperience #IncidentResponse #SecurityCommunications
If you want more experience thinking through communication challenges like these, subscribe to our weekly Discernible Experience.
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
By calling software "technology" instead of products, we've avoided decades of product safety standards and accountability.
Lisa LeVasseur, the Executive Director at Internet Safety Labs, breaks down why consent frameworks have failed, how many digital products follow the tobacco industry's manipulative playbook, and what security and privacy leaders can actually do about it.
New on the Discernible blog -- a conversation about moving from damage control to product safety advocacy: https://discernibleinc.com/blog/calling-technology-magic-is-bad-communication
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
During our new Discernible Experience this Wednesday, subscribers get to practice:
✓ Building evidence-based cases that persuade executive
✓ Adapting technical security recommendations for different stakeholder priorities
✓ Creating sustained leadership commitment (not crisis-driven panic that fades in 2 weeks)
✓ Communicating abstract threats into concrete business scenarios
Inspired by the recent European airport ransomware attacks, this scenario challenges you to navigate the delicate balance between "appropriately concerning" and "Chicken Little fear-mongering."
The hard part isn't knowing what security controls to implement. The hard part is convincing stakeholders to prioritize them.
Subscribe to join: https://discernibleinc.com/experience
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Your third-party AI service has been inadvertently exposing customer conversation data through its API responses for six weeks.
💫 Communication Challenge: How would you coordinate messaging between legal, customer success, and technical teams?
#DiscernibleExperience #IncidentResponse #SecurityCommunications
Communication advisors helping security and privacy teams grow political capital and influence beyond reporting lines. #SecurityCommunications #PrivacyCommunications
Messaging is the words you use, but communication is the strategic effort to change what someone thinks, feels, or does.
Read our new blog post 👇