Executive Summary
Sometimes during a crisis we don’t know how bad the situation really is. Consider the following scenario involving a data privacy violations: A company discovers that sensitive data about a user is exposed in an unencrypted database for 24 hours. Has anyone accessed it? If so, what, if anything, can they glean from it? Firms facing the question of whether and how to communicate risk often err too far in either direction. When organizations alert their customers to every potential risk, they create notification fatigue. When firms wait too long to…
