Crisis Communications can’t be a last-minute band-aid “fix”
A recent CNA interview with David Koh, founding chief executive of the Cyber Security Agency of Singapore (CSA), was fascinating. Reflecting on his 11 years protecting Singapore’s digital space, Koh mentioned a critical ingredient of cyber resilience often drowned out by the noise of technical jargon: the high-stakes reality of crisis communications.
He recalled the 2018 SingHealth data breach, where 1.5 million patient records were breached. In those high-pressure moments, CSA had a compressed 10-day window to answer three non-negotiable questions before making a public announcement:
- What exactly happened?
- How do we stop it?
- What can we tell the public definitively and accurately?
That 10-day pressure cooker perfectly encapsulates why crisis communications is never just a public relations task—it is an operational survival mechanism.
The Uphill Struggle: Fighting the “Emergency Hack” Mentality
For over three decades in public relations and crisis strategy, my biggest uphill battle with clients and prospects hasn’t been convincing them that crises happen. It has been trying to break the dangerous delusion that crisis communication is a last-minute hack—something you scramble to assemble after the server crashes or the scandal leaks.
When a breach or corporate disaster hits, calling a PR agency to “fix the story” in real time is like buying a fire extinguisher while your roof is already collapsing. You don’t improvise messaging when trust, reputation, and millions of dollars are on the line.
Crisis communication is not a magic wand you wave at a fire; it is the fireproofing you build into the architecture long before the spark occurs.
The Fire Drill Imperative: Why Readiness Requires Routine
Consider how commercial office buildings operate. Every quarter, tenants participate in mandatory fire drills. Bells ring, stairwells fill, and employees walk calmly to designated assembly points.
Why do we do this? Because when smoke actually fills a hallway, human panic takes over unless muscle memory steps in.
A sustained crisis management and communication program works on the exact same principle:
- Framework First: Standard Operating Procedures (SOPs), chain-of-command matrices, holding statements, and legal clearance protocols must exist in advance.
- Scheduled & Ad-Hoc Drills: Running announced quarterly simulations—as well as unannounced ad-hoc stress tests—forces leadership and operational teams to test their response times under simulated pressure.
- Refinement: Each drill exposes bottlenecks in your approval chain, allowing you to patch communication flaws before a real incident exposes them to the world.
Media Coaching: A Staple for C-Suite and Line Leaders
When Koh spoke of balancing public assurance with realistic vigilance, he touched on a subtle art: tone, timing, and transparency. In a live crisis, a single tone-deaf phrase from a CEO or an uncoordinated comment from a department manager can ruin credibility instantly.
This is why media coaching (media training) should be part of the standard curriculum for your entire leadership pipeline:
- C-Suite: Board members and executives need to show calm, authoritative empathy while throwing up strict factual boundaries under aggressive journalistic or public scrutiny.
- Line Leaders and Spokespersons: Operational leaders need to know how to translate complex technical outages into clear, simple, and accurate messaging without guessing.
- Frontline Employees: Staff must be clear on media escalation policies so the company speaks with one unified, fluent voice. AI Accelerates the Clock—Your Response Must Be Ready
As we can see, AI is shifting cyber threats from weeks of manual craft to minutes of automated execution. When an attack or crisis unfolds at AI-driven speed, you will not have time to hold a three-hour committee meeting just to draft a single press statement. Crisis preparedness is not an optional luxury or an administrative burden. It is a fundamental operational pillar. Build the program, run the drills, train your leaders, and make sure your team knows how to walk through the fire calmly before the smoke appears.
Talk to us today!
###
Dr Seamus Phan – Global C-suite Publicist & Strategist (Biochemist, Cybersecurity & Webdev pioneer, Author, Journalist) with nearly 40 years of professional field experience. Some articles are reproduced at McGallen & Bolden, where he is CTO and Head of Content. Visit him on LinkedIn.