Effective communication around security practices and incidents is vital for any business, especially a growing startup. Let’s explore the significance of security communications for startups, debunk misconceptions, highlight potential pitfalls, and provide actionable tips to ensure startups can handle security incidents effectively.

With the help of Izzi Lithgow, security comms expert and advisor at SafeAdvisory, we’ve put together everything your startup needs to know about security communications.

Understanding security communications

Security communications, often referred to as security comms, involves the way organisations communicate about security-related topics. While security comms is a relatively new concept in many regions, including New Zealand and Australia, it plays a vital role in shaping public perception, promoting awareness, building and maintaining trust, and ensuring staff and customers understand their roles in the complex realm of cybersecurity.

Misconceptions about security comms

One common misconception is viewing security communications as an optional or additional component, rather than an integral part of business operations. Startup founders and professionals with technical backgrounds often focus primarily on developing innovative products and neglect the importance of communicating security measures effectively. This mindset can lead to a lack of preparedness and can prove detrimental when dealing with security incidents.

Another pitfall is assuming that security communications should be laden with technical jargon. While technical expertise is valuable, security communications should be accessible to all stakeholders, including non-technical individuals. Making security information easily understandable helps build trust and ensures everyone can comprehend the implications of security incidents.

The power of effective security communications 

When done right, security communications can have a positive impact on the outcome of security incidents. By adhering to principles such as transparency, vulnerability, honesty, and accountability, startups can establish trust with stakeholders. Clear and concise communication during a security incident helps alleviate confusion and fear, reassuring both internal and external audiences that the situation is being handled appropriately.

Good vs. bad security comms

Several recent incidents highlight the significance of security communications. In the case of a financial and insurance breach in Australia (if you know, you know), poor communication led to a disconnect between the incident response, operational teams, and the public. The lack of consistent and understandable information caused confusion among affected individuals and even cybersecurity professionals.

Conversely, successful security communications can be seen in the case of Timehop, an app that suffered a breach. Timehop promptly provided transparent updates, maintained a dedicated webpage, and effectively communicated the potential data loss to its users. This approach ensured transparency and built trust, even among technical specialists.

How to implement security comms into your organisation

Startups - and rather, any business - can take several steps to prepare for effective security communications:

1. Adopt a proactive mindset: Understand that security incidents can happen to any organisation and prepare accordingly. Shift the perspective from "if" to "when" to foster a readiness to handle incidents.
2. Develop an incident response plan: Create a comprehensive plan that outlines the steps to be taken in the event of a security incident. Regularly practise tabletop exercises and simulations to build muscle memory and streamline the response process.
3. Ensure you have separate roles: Designate individuals responsible for security communications separate from those investigating and troubleshooting security incidents. This division of labour ensures focused and effective communication with internal and external stakeholders.
4. Prioritise simplicity and accessibility: Make security communications easily understandable to all stakeholders, regardless of their technical expertise. Avoid jargon and complex explanations, striving for simplicity in conveying critical information.
5. Establish communication channels: Identify and maintain a network of trusted individuals and resources that can provide assistance during security incidents. This network may include vendors, peers in the industry, or security professionals who can offer guidance and support.

Effective security communications are essential for startups to build trust, manage incidents, and ensure stakeholders understand their roles in maintaining cybersecurity. By prioritising transparent and accessible communication, startups can navigate security incidents with greater confidence and minimise the impact on their business.