Out-of-Band Communication: Your Incident Plan Assumes the Systems You're Using to Respond Still Work
Security Boulevard, Thursday, October 29th, 2026
Attackers watch email, chat and response calls during breaches, so incident teams need channels independent of corporate identity and systems.
This post is syndicated through the Security Bloggers Network from vendor BreachRx, and argues that incident response plans wrongly assume teams can coordinate over the same email, chat and conferencing systems an attacker may control, citing CISA and FBI warnings that Scattered Spider monitors Slack, Teams and response calls.
It points to Mandiant M-Trends 2026 data on faster attacker hand-offs and recovery-system destruction.
It says a Signal or WhatsApp group is not a real plan and lists requirements: independence from corporate identity, verified participants, prior enrollment, plans held in the channel, and a defensible record for SEC and NIS2 deadlines.
It closes by promoting BreachRx Out-of-Band Communication.