Cyber-Attack Hits. Now What? Communicating with Staff, Customers and Regulators

When a cyber-attack hits, the technical fix is only half the battle. What you say, to whom and when can determine whether your organization emerges with its reputation intact or makes a bad situation worse.
In this episode, Infosecurity speaks with Ashley Sweetman, director of cybersecurity at a London-based global bank, about how to get crisis communication right (6.53). Ashley is the co-author, of Communicating Cyber Risk: Build Cyber Resilience Through Compelling Communication.
Drawing on the book's insights, he talks through the do's and don'ts of communicating after a cyber-attack. He also explains how to tailor your message for senior leadership, staff, authorities and regulators, customers and the general public.
Ashley shares real-world cases that demonstrate what to do and what to avoid when the pressure is on. Whether you're a security leader, a comms professional, or someone who hopes never to need an incident playbook, this conversation offers practical lessons for the day it all goes wrong.
Resources:
• Communicating Cyber Risk: Build Cyber Resilience Through Compelling Communication, Nina Paine, Ashley Sweetman, KoganPage https://www.koganpage.com/risk-compliance/communicating-cyber-risk-9781398628618#contentgroupsection-reviews
• Incident Management: How to Ensure Your Organization Can Handle a Crisis – Infosecurity Magazine https://www.infosecurity-magazine.com/opinions/incident-management-organization/
• Responding to a cyber-attack, why crisis communication matters – Infosecurity Europe https://www.infosecurityeurope.com/en-gb/blog/guides-checklists/responding-to-cyber-attack-crisis.html
• Where to Report a Cyber Incident – UK Government https://www.gov.uk/guidance/where-to-report-a-cyber-incident
• Incident management: Helping to reduce the harm from cyber security incidents in the UK – UK National Cyber Security Centre https://www.ncsc.gov.uk/section/about-ncsc/incident-management
• Handling media attention after a major incident (last update: June 1, 2026) – UK Government https://www.gov.uk/government/publications/handling-media-attention/handling-media-attention-after-a-major-incident
• Incident Response - Computer Security Resource Center, US National Institute of Technology and Standards https://csrc.nist.gov/projects/incident-response
• Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (NIST SP 800-61 Rev. 3 – last update: April 2025) – US National Institute of Technology and Standards https://csrc.nist.gov/pubs/sp/800/61/r3/final