Direct answer. I would coach the junior to open with the business answer (what happened, what it means for customers and revenue, what we need from the CEO) and keep the technical detail in reserve for questions. I would give them a five-step checklist and rehearse it with them once, playing the CEO myself.
The five-step checklist
- Preparation: decide the one decision. Before any slides, write one sentence: "I need you to approve X by Friday" or "No decision needed, here is what you should know." Then collect only the facts that support it: what was affected, how many customers or records, whether it is contained, and what it costs. Check every number with the incident lead, because a wrong number in front of a CEO costs more trust than a missing one.
- Phrasing: business words first. Lead with impact, then cause, then fix. Replace jargon with its effect:
| Instead of | Say |
|---|
| "Attacker used a stolen API key (a password-like credential that software uses) to enumerate an S3 bucket (list the files in a cloud storage area) and download its contents" | "Someone used a leaked password-like key to read files from one storage area. It held about 40,000 customer invoices." (illustrative) |
| "Root cause: misconfigured IAM policy (the rules that decide who may access what)" | "A permission was set too wide when we launched the service in March." |
| "We're patching CVE-XXXX (the public ID number of a known software flaw)" | "We are closing the hole this week; until then we have blocked the route." |
Separate what is known, what is suspected, and what is unknown, and give a time for the next update. Never fill an unknown with a guess.
3. Visuals: one slide, one message. Use a simple timeline (found, contained, fixed) and a single impact figure. No log excerpts, no architecture diagram unless asked. Keep a technical appendix slide hidden for follow-ups.
4. Handling questions. Rehearse the three questions a CEO nearly always asks: "Is it over?", "Are customers affected and do we have to tell anyone?", "Could it happen again?" Teach the junior to answer in one sentence, then stop. If the answer is "I don't know," say "I don't know yet, I will confirm by 3 pm," and then do it. Questions about legal notification go to legal and the privacy officer (the person responsible for personal-data compliance); the junior states the facts and does not give a legal opinion.
5. Follow-up commitments. End with two to four commitments, each with an owner and a date ("Remediation plan (the written list of fixes and who does each) by Wednesday, owner: platform lead"), and send them as a short written note within a day. Then meet those dates, because the next briefing is judged on whether the last promises were kept.
Coaching method. Do a 10-minute dry run, interrupt as a CEO would ("so what?"), and give feedback on one thing at a time. Offer to sit in the first real briefing as a silent backup, but let the junior speak.
Pitfalls. Over-reassuring ("it's fully contained") before the facts are in; burying the ask on slide six; reading the timeline aloud; and letting the junior take legal or regulatory questions that belong to counsel. This is about explaining findings after the fact, not running the live incident communications.
