The first hour of an incident decides the next six months

Say three things and nothing else: what you have observed, what you have already done about it, and when you will next speak. A timestamped holding statement with a named human behind it buys hours. Silence buys nothing and costs the narrative, because someone else will fill it within minutes.

The three statements that make everything worse. "Funds are safe" before you have confirmed it — you may have to retract the only sentence anyone remembers. "No user impact" when you mean no impact you have found yet. And "we were targeted by a sophisticated attacker", which reads to everyone as an excuse and invites people to prove it was not sophisticated at all.

Split the room early. One group stops the bleeding, one group talks, one person decides. The people writing the statement must not be the people reading the logs, and the decider needs authority to spend money and pause the product without a meeting. Most incidents get worse because those three jobs sat in one overloaded founder.

Then, when it is over, publish the boring version: timeline, cause, what changed. A dull, specific post-mortem does more for credibility than any amount of reassurance during the event — and it is the document that gets quoted for years afterwards, so it is worth writing carefully.