What to say and what not to say

Before we get into the various types of products and deliverables, we need to discuss the elephant in the room (again) – communication.

The words, pictures, and graphs that the team decides to use have meaning and power beyond what the team intends them to convey. These images and words will be received by an audience that you do not directly interface with and the team will not have the ability to adjust that perception after the fact. The audience you write the report for isn't the only audience that interprets it. The report could be utilized in legal proceedings or leaked to the press. What you produce will be out in a world that is beyond your control.

Real-World Example

After a lengthy threat hunt, the team included a briefing for the executive leadership in their deliverables on everything that was identified and the perceived root causes of any adversarial activity. During this hunt, an intrusion began as a user was compromised...