I have a client that is wanting me to incorporate real world examples of companies that have experienced data breaches recently. They want me to list company names and the effects of the breaches. I am aiming to advise them that this is not the direction we want to go and it would be better to generalize our real world examples.
I'm struggling to find the words to pose my 'argument' against not placing those third party organizations in a potentially bad light.
May be better to have some real world headlines. I built some finance courses last year that we used real world examples where companies had been fined lots of money because of breaching new guidelines, this was much more powerful than using generalised examples.
Thank you for the insight. Would it change your opinion if I told you those other organizations were potential clients of ours as well? I have 50,000 users for this training through the one client.
Depends on if the client would ever see the training, if it is likely to damage the reputation with your other clients or cause you some form of repetitional damage then you may need to explain the conflict of interest. I can see where this may cause an issue.
My feeling is that if the information is in the public domain then it is fair game. Real world examples are always better. I develop IT security awareness training for one of my clients who specializes in that area and we often us real world examples of companies who have had data breaches.
You could always provide the example but not name the company - just say a large retailer etc. It is not as powerful but still gets the job done.
Hi Tiffany. I think you're wise to present some creative alternatives to this idea. Depending on your industry, it can be a small world so citing specific instances can be a powerful reminder, but it can also come across as a petty attempt to score points. Besides, we are all stewards of the larger data ecosystem.
One alternative could be a general reference to "a nationwide electronics retailer" (for example). Another option that could be to focus on how individuals are impacted by a breach. This could be done with an immersive activity that lets the learner experience the personal costs of a data breach—e.g. the far reaching impacts of ruined credit or lost reputation. On the whole, people relate to things that are made more tangible and personal. We feel protective of individuals more than companies in my experience. I think that's a powerful perspective that could achieve your client's goals without casting aspersions.
I agree re: if the info is in the public domain then it's fine to use, it's not like you'd be using insider knowledge from one client to benefit another.
Thank you everyone for your feedback. I'm trying to balance the power of a real world situation with the fact that we have a global audience and also would be including potential clients' information in a not-so-favorable light.
What about data breaches PLUS their solutions? I'm going to use Sony for an example, "Sony experienced a high profile data breach that they quickly extinguished by doing (X). They prevented future data breaches by doing (Y), and gave their customers (Z) to show their commitment to keeping their data safe."
And then go into, "Data breaches can happen to any company, large or small, including us" to make it all inclusive (e.g. not "bashing" the other companies for having data breaches.)
I completely understand where you're coming from. I used to create training for correctional facilities, and one of the big things was making sure we didn't show correctional officers in a bad light. The reality was, however, that we needed to show officers doing the "wrong" thing in order to make impactful training. So, we always made sure to show how it turned out positive and didn't put "negative" images within the training. So when you are putting in these case studies, just put neutral images or even positive images within it.
12 Replies
May be better to have some real world headlines. I built some finance courses last year that we used real world examples where companies had been fined lots of money because of breaching new guidelines, this was much more powerful than using generalised examples.
Thank you for the insight. Would it change your opinion if I told you those other organizations were potential clients of ours as well? I have 50,000 users for this training through the one client.
Depends on if the client would ever see the training, if it is likely to damage the reputation with your other clients or cause you some form of repetitional damage then you may need to explain the conflict of interest. I can see where this may cause an issue.
My feeling is that if the information is in the public domain then it is fair game. Real world examples are always better. I develop IT security awareness training for one of my clients who specializes in that area and we often us real world examples of companies who have had data breaches.
You could always provide the example but not name the company - just say a large retailer etc. It is not as powerful but still gets the job done.
Hi Tiffany. I think you're wise to present some creative alternatives to this idea. Depending on your industry, it can be a small world so citing specific instances can be a powerful reminder, but it can also come across as a petty attempt to score points. Besides, we are all stewards of the larger data ecosystem.
One alternative could be a general reference to "a nationwide electronics retailer" (for example). Another option that could be to focus on how individuals are impacted by a breach. This could be done with an immersive activity that lets the learner experience the personal costs of a data breach—e.g. the far reaching impacts of ruined credit or lost reputation. On the whole, people relate to things that are made more tangible and personal. We feel protective of individuals more than companies in my experience. I think that's a powerful perspective that could achieve your client's goals without casting aspersions.
Ha! Nancy I typed public domain and then removed it :-)
I agree re: if the info is in the public domain then it's fine to use, it's not like you'd be using insider knowledge from one client to benefit another.
Thank you everyone for your feedback. I'm trying to balance the power of a real world situation with the fact that we have a global audience and also would be including potential clients' information in a not-so-favorable light.
It's a difficult one as potentially your conflict of interests could prevent you from providing your current client with what they want/need.
What about data breaches PLUS their solutions? I'm going to use Sony for an example, "Sony experienced a high profile data breach that they quickly extinguished by doing (X). They prevented future data breaches by doing (Y), and gave their customers (Z) to show their commitment to keeping their data safe."
And then go into, "Data breaches can happen to any company, large or small, including us" to make it all inclusive (e.g. not "bashing" the other companies for having data breaches.)
I completely understand where you're coming from. I used to create training for correctional facilities, and one of the big things was making sure we didn't show correctional officers in a bad light. The reality was, however, that we needed to show officers doing the "wrong" thing in order to make impactful training. So, we always made sure to show how it turned out positive and didn't put "negative" images within the training. So when you are putting in these case studies, just put neutral images or even positive images within it.
Great minds eh!
I would take legal advice - anything like this, not mater whether in public domain or not can attract legal attention.
This discussion is closed. You can start a new discussion or contact Articulate Support.