During an incident, publish confirmed facts only, and label anything else as under investigation. Early guesses about who attacked you or what failed are often wrong, and corrections look worse than silence. Separate three things in every message: what you know, what you believe, and what you have not checked yet.
Why early guesses fail
Initial evidence is partial. A suspicious login might be a researcher. A vendor flagged first might be a victim, not a cause. An exploited component might be a symptom of an earlier credential theft. Teams that announced a cause on day one often change it by day five.
Three buckets for every statement
Known. Verified by logs or reproduced. State plainly.
Believed. A working theory. Keep it internal, or if you must share it, mark it clearly as preliminary.
Unknown. Say it is unknown, and say when you expect to know more.
Publishing from the first bucket only is the safest rule.
Attribution
Naming a threat group or a country needs evidence that most companies cannot gather quickly. Leave attribution to authorities and specialists, and do not repeat third party claims as your own. See primary vs secondary sources in security news for how to judge what you read.
Root cause
Say "we are investigating the cause" until you can show it. When you do know, describe the mechanism, not a person. A fix that closes one path is not proof that no other path exists, so avoid "this can no longer happen".
Internal discipline
- Mark the shared incident document with the three buckets.
- Ban speculation in customer channels and with press.
- Give support and sales a short line to use: "The investigation is ongoing and we will share confirmed findings at [URL]."
- When a fact changes, publish a correction with the date and what changed.
Handling pressure
Executives, customers and reporters will all ask for a cause. The honest answer is a time for the next update. That is a real answer and it protects credibility.
Quick check
What if a reporter publishes a wrong cause?
Correct the confirmed facts on your own page, politely, and avoid arguing about the rest.
Can we say we have no evidence of misuse?
Only if you looked in the right places, and say where you looked.
Last reviewed: 19 October 2026.
