It would be helpful to include what specifically went wrong when there is a security incident at your company. Every failure should be a learning opportunity fo

It would be helpful to include what specifically went wrong when there is a security incident at your company. Every failure should be a learning opportunity for others. Perhaps there should be some sort of safe harbor for disclosing security compromises as it benefits the greater community. I can understand why you'd want to cover your ass in this type of situation. However, I think keeping these things secret leads to more harm over time as people brush off weaknesses in their own systems for lack of concrete examples of where it caused harm. Was an employee careless with credentials? Was some service not updated? Was it a typical attack like a SQL injection that caused the leak? Having more real world info helps people model threats better.