Skip to main content

Crisis protocol: threat assessment and rapid response

Our write-up of a story first reported by Cossa

Crisis protocol: threat assessment and rapid response

Reputational crises rarely follow a schedule. A brand can shift from stable to trending for the wrong reasons within hours. The first 24 hours determine whether a company contains the damage or manages its aftermath.

In the early stages, before audiences form fixed opinions and algorithms amplify the signal, a narrow window exists to shape the narrative. Most companies squander it by waiting for legal clearance. By the time sign-off arrives, others have already written the story.

Assessing the real threat

Not every surge of criticism is a crisis. Before mobilising resources, four parameters need quick evaluation: reach (one angry customer or organised pressure), source (anonymous account or credible publication), subject matter (operational failure or systemic breach), and trajectory (fading or accelerating).

These determine how much force to deploy in response.

Building the crisis unit

Before any public statement, three or four people with actual authority must coordinate inside the company: PR, legal counsel, the relevant operational lead, and someone from senior management. Each owns a lane—facts, legal exposure, messaging strategy. Decisions move fast because consensus-building consumes time the company does not have.

Verifying facts first

Public claims must be verified beforehand. If a statement later proves inaccurate, the reputational damage stacks on top of the original crisis. The team answers internally before speaking publicly: what exactly happened, when and where, who was affected and at what scale, and what evidence supports the company's position. Incomplete knowledge is not disqualifying; presenting incomplete knowledge as complete is.

Choosing the first response

The initial public move should not be defence. It should show the company understands the situation and is working through it. The formula is straightforward: acknowledge the problem, confirm the company is investigating, state when the next update arrives. Skip unnecessary detail and promises that cannot be kept.

Respond through the channel where the crisis is unfolding. If the pressure is in Telegram channels, answer there. If in business media, use the press office. A formal statement on the company website does not reach audiences arguing on social platforms.

What not to do in the first hours

Deletion of comments and posts backfires—screenshots exist already, and removal reads as guilt. Attacking critics reframes the story from problem to conflict, one the company almost always loses. Silence beyond a few hours without explanation invites speculation, rarely in the company's favour. Template corporate language without specifics ('we value every customer') fuels mockery, not confidence.

Real-time monitoring

While the crisis unit works, continuous monitoring tracks how sentiment shifts, which new claims emerge, and who is amplifying them. This runs for the full 24 hours; a seemingly dormant issue can reignite from a single repost wave.

If the first day passes without public errors, half the battle is won. Detailed explanations and remedies follow. But the foundation—who controls the narrative—is set now.

Project sponsors

Companies that keep this analytics open
Gold sponsor

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor