You are thirty minutes into a serious incident and the executive team wants an update. What do you tell them?

Give them impact, confidence and next steps in plain language, with uncertainty stated explicitly. Cover what is affected and what is not, what you are doing right now, what decision you need from them, and when the next update lands. Avoid tool names and technique jargon, do not speculate about attribution, and clearly separate confirmed facts from working hypotheses so nobody acts on a guess.

I keep it to four things. What we know: email is degraded for the sales team, roughly forty accounts affected, and no evidence yet that customer data was accessed. What we are doing: sessions revoked on those accounts, forced password resets in progress, and we are reviewing mail rules for signs of forwarding. What I need from you: a decision on whether to take the shared mailbox offline, which stops inbound orders for about an hour. Next update: forty five minutes, or sooner if the picture changes materially. I am deliberate about labeling confidence, so I will say we have confirmed this and we currently believe that but have not proven it, because executives repeat what you tell them to customers and regulators, and a hypothesis repeated as fact becomes a legal problem. I also never guess at who did it in an early briefing. Attribution is the first question people ask and the least useful one at thirty minutes in.