Certified: The GIAC GCIL Audio Course

When an incident is unfolding, stress does something sneaky to communication: it makes everyone talk faster while thinking less carefully about what their words actually do. In calm times, people can tolerate a little ambiguity because there is time to clarify, but in a crisis, ambiguity turns into confusion and confusion turns into bad decisions. Controlling the message does not mean controlling the truth or hiding information; it means making sure that what you share is accurate, consistent, and useful for the people who need to act. The audience might be leaders who must decide whether to shut down a service, staff who need to know what behavior is safe, or technical teams who must coordinate without stepping on each other. Under pressure, you cannot rely on everyone to interpret language the same way, because different roles hear the same words differently. This is why briefings, updates, and terminology are not just soft skills in incident work; they are part of the machinery that keeps response efforts aligned and prevents mistakes that add damage.

A good way to understand message control is to notice how small differences in language can cause big differences in behavior. If one person says breach and another says incident, listeners may assume the situation is either confirmed data theft or just a minor alert, even if both speakers mean the same thing. If someone says compromised, some people will hear that as confirmed attacker control, while others will hear it as suspicious activity that might be contained. If an update uses the word safe too casually, people may stop taking precautions, even though the investigation is still in progress. Controlling the message means choosing terms that match the evidence you actually have and using them consistently across all updates. It also means avoiding terms that are emotionally loaded or legally charged unless you truly intend those implications. For beginners, the key insight is that terminology is not decoration; it is a tool for guiding understanding when time and attention are limited.

To make language consistent, you need a shared vocabulary that separates what is known from what is suspected, and you need to use it the same way every time. One useful approach is to distinguish between an event, which is something observed, and an incident, which is an event that matters enough to trigger response. You can also distinguish between impact, which is what people experience, and cause, which is why it happened, because the cause is often unknown early on. Another important distinction is between access and misuse, because evidence of access does not automatically mean evidence of harm. When teams do not use these distinctions, updates often blend them together, and the story becomes unstable as facts change. A stable story is not one that never changes; it is one that changes in a controlled way, where new facts replace old assumptions without flipping the meaning of earlier communications.

Briefings are the moments where you translate a messy reality into a shared picture that people can make decisions from. A briefing should not be a stream of technical facts, because raw data overwhelms most listeners, and it should not be a motivational speech, because motivation does not replace clarity. A strong briefing answers a few essential questions with discipline: what is happening, what is the current impact, what is being done right now, what decisions are needed, and when the next update will arrive. Notice what is missing from that list: long technical explanations, speculation about attackers, and detailed guesses about root cause. The goal is to create alignment, not to impress anyone. When you control the message in a briefing, you reduce side conversations, reduce conflicting instructions, and reduce the impulse for people to fill gaps with rumors.

Updates are similar to briefings, but their purpose is even narrower: keep everyone synchronized as the situation evolves. Under stress, people often think updates should always be packed with new information, but that mindset can push teams toward unsafe speed and sloppy certainty. An update can be valuable even when little has changed, because it confirms that someone is watching the situation and it prevents people from creating their own stories. The best updates repeat key terms and key facts in a consistent way so that listeners can anchor on them. This repetition is not redundancy; it is stability, and stability is calming in a crisis. A disciplined update rhythm also helps prevent random interruptions, because stakeholders know they will not be ignored, and that reduces the temptation to demand constant one-off explanations from responders.

Consistency also depends on controlling who communicates and how messages are approved, because too many voices create a chorus of contradictions. In an incident, it is common for well-meaning people to speak on behalf of the organization without realizing it, especially in internal chat channels or quick hallway conversations. Those informal statements can travel far, and they can be interpreted as official even when they are not. Message control works best when there is a clear communications owner who can coordinate with technical leads and leadership and publish a single authoritative update for each audience. That owner does not have to write everything alone, but they should be the one who ensures language consistency, removes unsafe detail, and confirms that the message matches the current evidence. Beginners sometimes worry that this slows things down, but the reality is that it often speeds response by reducing confusion and rework.

A practical way to keep terminology consistent is to use a small set of defined phrases that you reuse across briefings and updates, especially for uncertain areas. For example, if you have not confirmed data exposure, you might use a phrase like assessing potential exposure instead of rotating through a dozen variations that imply different levels of certainty. If you have not confirmed whether the attacker is still active, you might use language that focuses on containment actions underway rather than declaring the environment clear. The purpose of defined phrases is not to sound scripted; it is to avoid accidental escalation or accidental minimization. Under stress, the human brain reaches for strong words, and strong words can become commitments. A defined phrase set helps you avoid making commitments you cannot support with evidence, while still being direct about what is happening and what is being done.

Another major part of controlling the message is keeping internal and external communication aligned without mixing them together. Internal audiences can often handle more nuance, because they are part of the response and can be instructed on safe behavior. External audiences, such as customers or partners, often need a simpler message that focuses on impact and actions, because detailed internal mechanics can create risk or misunderstanding. Problems happen when an internal technical statement is repeated externally without context, or when an external public statement is repeated internally and makes responders feel constrained or pressured. Message control means building parallel narratives that are consistent in meaning but tailored in detail. The internal narrative can discuss what is being investigated and what evidence exists, while the external narrative can focus on service impact, steps being taken, and how people will be informed as facts become clear. Consistency here is about meaning, not about word-for-word duplication.

Controlling the message also means controlling the emotional temperature of the room, which is not the same as being soothing. Under stress, people crave certainty, and if you cannot give certainty, they may become anxious or angry. If you respond by sounding overly confident, you might calm them temporarily, but you also increase the risk of later contradiction. A better approach is to be steady and specific about process, because process is something you can be confident about even when facts are incomplete. You can confidently say what is being done, what is being prioritized, and what the next decision point is, without claiming results you do not yet have. This steadiness helps leaders make better decisions because they are not reacting to emotional spikes caused by dramatic language. It also supports responders because they can focus on work instead of constantly managing panic.

There is also a subtle technical reason to control terminology: words can change how responders interpret evidence. If an early message frames the situation as ransomware, responders may focus on encryption symptoms and miss signs of data theft or credential abuse. If the message frames it as a denial of service, teams may focus on traffic patterns and overlook a separate intrusion. Early labels become mental filters, and under stress, people cling to filters because they simplify complexity. Message control means resisting the urge to label the incident type too early and instead describing observed behaviors and impacts. As evidence grows, you can narrow the description, but you do so deliberately, acknowledging what changed and why. This keeps the team’s mental model flexible, which improves accuracy and reduces wasted effort.

To keep updates consistent over time, you need to carry forward a stable set of facts, even as details change. Think of this as maintaining a running summary that includes what is confirmed, what is still being investigated, what actions are underway, and what decisions are pending. Each new update should start from that summary rather than starting from scratch, because starting from scratch invites language drift. Language drift is when the story slowly changes because different people describe it differently, not because the facts changed. Drift causes stakeholders to ask the same questions repeatedly because they are not sure whether new wording represents new facts. When you control the message, you intentionally reuse key phrases and structure so that any real changes stand out clearly. That makes your communication more efficient and reduces the chance that someone misreads a minor wording change as a major shift in reality.

It is also important to control the message by separating operational instructions from situational updates, because mixing them can cause people to miss critical actions. For example, a long paragraph describing investigation status can bury a simple instruction like do not click suspicious links or report unusual prompts. Under stress, listeners often remember the strongest emotional content, not the most important actionable content. Message control means placing operational instructions in clear, repeated language and keeping them stable unless they truly change. If you frequently change instructions, people may stop paying attention or assume the latest message contradicts the previous one. If instructions must change, you should explicitly state that they changed and why, because that reduces confusion. For beginners, the key is that an update is not only information; it is guidance, and guidance must be easy to find and easy to repeat accurately.

Another element that helps control the message is making sure that technical details are translated into impact language for decision-makers without losing accuracy. A technical team might say that authentication tokens are being replayed, but a leader needs to know what that means for access risk and what actions reduce that risk. Translation is not dumbing down; it is mapping a technical condition to an operational consequence. Under stress, poor translation can lead to wrong decisions, like shutting down the wrong service or ignoring a critical exposure. A good translator can say that there are signs of unauthorized account access attempts, that protections are being tightened, and that certain user actions may be required to protect access. This communicates the essence without forcing leaders to interpret low-level jargon. It also reduces the chance that leaders will repeat technical terms incorrectly in broader communications.

To keep terminology consistent across a team, you can also use a simple habit: after any briefing, make sure the same short summary is what everyone repeats. If the response lead says one thing and a technical lead says another, stakeholders will choose the version they prefer, and that becomes a rumor factory. A shared summary is like a single source of narrative truth, even if the underlying investigation is complex. That summary should avoid unstable details like suspected vulnerability names or unconfirmed attacker actions. It should focus on confirmed impact, response actions, and next steps. Over time, this shared summary becomes a stabilizing anchor that helps people remember what is real and what is still in motion. The discipline here is not to polish the story; it is to keep the story coherent.

As you wrap this up, remember that controlling the message is really about controlling meaning when stress tries to break meaning apart. Briefings create alignment by giving a shared picture, updates maintain alignment by reinforcing stable language and highlighting real changes, and consistent terminology prevents accidental escalation, accidental minimization, and wasted effort. This is not about being perfect with words; it is about being reliable with words, especially when uncertainty is high. When your communication is reliable, stakeholders trust the process even when the facts are still forming, and responders can focus on evidence rather than on rumor control. If you can learn to choose careful terms, repeat them consistently, and separate confirmed facts from assumptions, you will reduce secondary damage and improve decision-making during the most stressful moments of incident work. That is what it means to control the message in a way that protects the response and the organization at the same time.