At Dropbox we had an explicit fallback on the DFIR team for the situation where our normal communication methods were considered compromised (not going to give

At Dropbox we had an explicit fallback on the DFIR team for the situation where our normal communication methods were considered compromised (not going to give details, obviously). I would hope that most security teams at a company of similar size have discussed this situation, it's not at all uncommon for attackers to sit in on calls, read messages between security people, or even access the SIEM to see what alerts are going off.