It is 3:47 AM. For five minutes, the monitoring system has been showing abnormal connections. Servers are no longer responding. Screens go dark. The team assumed it was maintenance. It was not.
This is no longer an incident. It is a crisis.
At that moment, the question is no longer “what is happening?” It becomes: who leads? who decides? and what does the organisation rely on to get through the first five hours?
Prevention alone is no longer enough for effective cyber crisis management
The fundamentals remain essential: MFA, patch management, system hardening, access control. However, even the most solid defence eventually breaks. The average cost of a data breach reached USD 4.44 million in 2025 (IBM, Cost of a Data Breach 2025). Furthermore, according to Mandiant’s M-Trends 2026 report, the global median attacker dwell time is 14 days before detection, during which attackers map the network, escalate privileges, exfiltrate data and prepare encryption.
The real question is therefore no longer “how do we prevent the attack?” It is: “what happens to our organisation when the attack succeeds?”
Why cyber crisis management plans fail under real pressure
Most organisations have an incident response plan. Many discovered it was unusable on the day they needed it most, because it was stored on the very servers encrypted by the attack. Others had carefully encrypted their backups, but kept the decryption keys inside the compromised environment. Preparation on paper and operational preparedness are two different things.
Inside a crisis cell, information arrives fragmented, out of context, in a continuous stream. Decisions must be made with incomplete data, under pressure, often in the middle of the night. What makes the difference is not the quality of the written plan. It is the collective capacity to decide despite uncertainty. That capacity is not built in an emergency. It is trained.
Moreover, a cyber crisis does not only affect technical teams. It reaches the entire organisation: the receptionist answering incoming calls, the team that reconnects a workstation during containment, the executive whose device was poorly secured because they found the controls inconvenient. Every link in the chain matters, and every unprepared link can make the situation worse.
Pressure-tested simulations: the only valid test
An exercise prepared the night before by teams who studied the response plan does not test resilience. It tests memorisation. Organisations that cope best train under genuine pressure: fragmented information, degraded communication channels, decisions to make without full visibility. Operational maturity reveals itself in that discomfort.
Cyber resilience must be built before a crisis, not during
Case in point: In March 2019, Norsk Hydro, one of the world’s largest aluminium producers, suffered a ransomware attack that paralysed 35,000 employees across 40 countries and 160 sites. Within hours, executives made three decisions: pay no ransom, bring in external experts to restore operations, and communicate with full transparency. Teams reverted to manual operations for weeks, pulling reference manuals from physical archives. The total cost exceeded USD 71 million. Yet the company’s reputation emerged stronger, precisely because the quality of the response was beyond reproach. Source: Microsoft News, 2019.
Communication is an integral part of the response. A crisis can escalate far beyond its actual severity if communication is delayed. Organisations that attempt to minimise or conceal an attack expose themselves to additional risk: information generally leaks through an external source, with a reputational impact far more damaging than a proactive statement. ENISA recommends a precise order: employees first, then stakeholders, then customers, then the press.What NIS2 and DORA have already established on cyber crisis management
NIS2 requires notification of a significant incident within 24 hours. DORA requires documented and auditable operational resilience testing. GDPR requires notification of any personal data breach within 72 hours. Consequently, an organisation unable to activate a structured cyber crisis management response is not simply in operational difficulty: it simultaneously becomes non-compliant with three major regulatory frameworks.
From conviction to cyber crisis management capability
The organisations that will survive future crises will not be those with the most sophisticated defences. They will be those whose teams know precisely which systems are critical, how to isolate them, who has the authority to decide and who communicates with whom. They will be those whose executives have already made real decisions under pressure, in a simulated setting, before a real situation forces them to.
An organisation that collapses the moment prevention fails was never truly secure. It was simply protected, until its first real failure.Building this resilience requires specific work: mapping the most probable scenarios, testing plans offline before they are needed, preparing executives to decide under pressure and employees to hold their role under constraint. This is what Stroople supports, through tailored cyber crisis management exercises designed for organisations that want to know, before an incident occurs, whether they are genuinely ready.
Certification: Stroople is Qualiopi-certified. Cyber crisis management training programmes are eligible for OPCO funding under French professional training frameworks.
Share:
Cyber crisis management: be ready before reality forces your hand
Stroople supports organizations at every stage of this continuum: before the crisis to structure the framework, during to test it under immersive conditions, and after to turn lessons learned into lasting resilience.
