Executives need four things in the first 24 hours of a zero-day: how exposed the company is, what has been done, what decisions they must make, and when the next update arrives. Give a short, honest status, mark unknowns as unknown, and avoid technical detail unless asked.
What leaders actually want to know
An executive does not need the CVE description. They need to know whether customers, revenue or regulated data are at risk, whether the company can keep operating, and whether anyone outside the firm must be told. Lead with those.
A one-page brief
| Heading | Example content |
|---|---|
| Situation | A flaw in [product] is being exploited. We run it in [places]. |
| Exposure | [Number] systems checked, [number] affected, [number] unknown |
| Actions taken | Stopgap on public systems, patch testing under way |
| Decisions needed | Approve an emergency change window, approve customer notice |
| Next update | Time and channel |
Use counts from your inventory, not guesses. If the inventory is incomplete, say what share you have covered.
Decisions to put in front of leaders
Most zero-days need only a few executive decisions.
- Whether to approve an out-of-hours change window.
- Whether to take a system offline, with the business cost stated.
- Whether to notify customers or regulators, which may involve legal counsel.
- Whether to pause releases that depend on the affected component.
State the recommended option and the cost of each alternative. Executives decide faster when they see a recommendation.
Public companies and the clock
The SEC requires registrants to file a Form 8-K Item 1.05 disclosure for a cybersecurity incident they determine to be material, within four business days of that determination. A vulnerability alone is not an incident, but a confirmed compromise might be. Legal and finance leaders should be in the loop early so the materiality question is asked at the right time. Ask counsel how this applies to your company.
Keep the cadence
Send the update when you said you would, even if nothing changed. A predictable rhythm, for example every four hours on day one and then daily, reduces ad hoc requests that distract the response team. Assign one person to write the brief so engineers can keep working.
Common mistakes
Three errors repeat. Briefs that open with technical detail lose the room. Briefs that promise a fix time the team cannot control create distrust. And briefs that hide unknowns get corrected later in public. Say what you know, what you do not, and when you will know more.
Quick check
Should executives get technical detail?
Offer it in an appendix. The main page should answer exposure, actions, decisions and timing in plain language.
What if we do not know yet?
Say so, name what you are checking, and give the time you expect an answer. Honest unknowns build trust.
Sources
Last reviewed: 19 October 2026.
