Lion Cipher Lab
Tailor one incident report to three audiences
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
One incident almost never has one reader. The same phishing compromise has to be handed to the analyst next to you who will hunt for it, to the manager who has to staff the cleanup and answer to their own boss, and to an executive who may have to approve customer notification and spend money. Write it once, in one voice, and you lose two of those three readers -- the peer drowns the manager in jargon, or the executive-friendly version leaves the analyst without the indicators they need. The skill that fixes this is audience analysis: figuring out who each reader is, what decision they have to…
What you'll learn
- audience analysis: naming who reads a report and what each reader must decide
- writing the same incident three ways -- for a technical peer, a manager, and an executive
- leading every version with a BLUF (Bottom Line Up Front) pitched to its reader
- translating technical detail into business impact (money, downtime, reputation, compliance)
- deciding what to keep and what to cut for each audience
- producing a technical write-up, a manager update, and a one-page executive brief from one set of facts
Steps in this lab
- What this lab is: one incident, three readers
- The incident you will work from (read this once)
- Audience analysis: name your three readers first
- The one move all three share: open with a BLUF
- Version 1 -- the technical analyst peer (keep the detail)
- Version 2 -- the non-technical manager (translate to plain language)
- Version 3 -- the executive or board (lead with the decision, speak business impact)
- Side by side: one fact, three treatments
- Why the re-sort, not the rewrite, is the whole skill