An executive wants your incident briefing to name the attacker group. How do you answer?

## Why the question is asked at all The executive is not being unreasonable. They are about to face a board, a large customer, an insurer or a journalist, and a name feels like the difference between being in control and not. "Sophisticated state-sponsored actor" also does organisational work: it makes the intrusion sound unavoidable. That secondary motive is worth recognising, because it is the reason the pressure keeps coming back after you have said no once. ## Separate the request from the need The move that works is to answer the underlying decision rather than the literal question. Ask what they have to decide in the next twenty-four hours. Typically: - Are we still exposed right now? - Does anything about tomorrow's operations change? - Do we have to tell anyone, and when? - What do I say if I am asked directly? A name changes almost none of those answers. Show that explicitly - "if I told you a name tonight, would any of those four decisions be different?" - and the conversation usually reframes itself. Then give them what does help: what you know happened, over what window, what has been contained, what is still uncertain, and a short line they can safely say aloud. ## What a briefing may assert Stay at the level the evidence supports, which in practice means observed behaviour and the artefacts behind it: which identity was used, which systems were touched, what actions were taken, when. Behavioural descriptions and technique identifiers are usually defensible because they describe what was done. Statements about *who* did it are of a different kind entirely - they are an assessment built on a body of evidence over time, produced by the intelligence function under its own standard, and they belong in that product rather than in an operational update. Conflating the two is how a briefing acquires a claim nobody can support. Be equally careful with the negative assertions executives push for: "no customer data was taken" is a much stronger claim than "we have found no evidence of customer data being taken", and only one of them is usually true. The absence of evidence in your telemetry is a statement about your collection. ## The costs of naming early - **It cannot be retracted quietly.** Once a name is in a board pack it reaches customers, insurers and press. Correcting it later is a second incident with its own news cycle, and it damages every other statement you have made. - **It steers the investigation.** If the team believes it is facing a particular actor, it starts looking for that actor's known playbook and stops looking at what the evidence actually shows. This is a real operational harm, not just a communications one, and it is the argument that lands best with technical executives. - **It invites questions you cannot answer.** "Why us?", "Are they still inside?", "Will they come back?" - all reasonable follow-ups to a name, none of them answerable from a similarity of tooling. - **It can commit the company externally** in ways that involve lawyers, insurers and government relations, which is precisely why the claim should not first appear in an operational status update at 02:00. ## When you are overruled You may lose this argument, and losing it is not misconduct. The executive owns the external position and carries the consequences. What you owe them at that point is not resistance but precision: draft the strongest wording that is still defensible, mark clearly which parts are established fact and which are assessment, and make sure they know which sentence is the one that could be wrong. Then record the advice you gave and who decided, in writing. That record is not a defensive gesture; it is how the organisation learns whether the call was right. The one thing you should not do is supply a name you do not believe in because it is easier than the argument. Everything else in your briefing derives its weight from your willingness to say "I do not know" when you do not. ## The organisational fix The repeat version of this problem is solved before the incident, not during it. Agree in advance who is allowed to make attribution statements externally, what evidence standard applies, and that operational briefings carry facts and uncertainties rather than conclusions about responsibility. Give executives a rehearsed answer to "who did this?" that they are comfortable saying in public - one that describes what happened, states that responsibility has not been established, and explains that the company does not speculate. Executives are far more willing to hold that line when they have practised it than when they hear it for the first time from a tired responder at two in the morning.