How to write a five sentence executive summary for a postmortem

An executive summary for a supply chain postmortem needs five sentences: what happened, who or what was affected, what you did, why it was possible, and what changes. Write it last, put it first, and make every claim one the body can back up.

Why five sentences

Leaders, customers and auditors often read only the top of a postmortem. If that top is vague, they will fill the gap themselves. A fixed shape keeps the summary honest and short enough to survive being pasted into an email.

The five sentences

1. What happened. Name the dependency and the event in plain words. "A malicious version of a build tool dependency was published and resolved by our CI between two dates."
2. Who was affected. State confirmed scope and state what is still unknown. "Three internal build jobs ran the code. We found no evidence of data access and are still reviewing two logs."
3. What we did. Containment and recovery in one line. "We blocked the version, rebuilt affected images from clean inputs and rotated the credentials those jobs held."
4. Why it was possible. The system conditions, not a person. "New versions entered builds automatically, with no delay and with broad secrets available to build jobs."
5. What changes. The two or three actions that matter, with dates. "We will pin versions, add a waiting period for new releases and narrow build secrets by the end of next month."

Before and after

Weak: "We experienced a security incident involving a third party library. The team responded quickly and the issue is resolved. We take security seriously."

Better: "A malicious version of a logging dependency ran in three of our build jobs on two dates. We have found no evidence that data left those jobs and one log review is open. We blocked the version, rebuilt, and rotated the job credentials. It was possible because builds took new versions automatically and carried broad secrets. We are pinning versions and narrowing secrets, with owners and dates listed below."

The second names scope, admits an open item and ties actions to causes. It also avoids the reassurance phrases that readers discount.

Rules for the wording

• Use dates, not "recently".
• Say "no evidence of X so far" only when you can say what you checked.
• Avoid the words "sophisticated" and "isolated" unless the body proves them.
• Do not name individuals.
• Use the same terms as the body. If the body says "exposed", the summary should not say "compromised".

Check it against the body

After writing, read each sentence and point to the section that supports it. If you cannot, rewrite the sentence or the section. Then have someone who was not in the incident read the summary alone and say what they think happened. If their version differs from yours, edit until it does not.

Quick check

Last reviewed: 19 October 2026.