Crisis Communication Playbook
A detailed, actionable guide to handling PR crises — from the first 48 hours through long-term reputation recovery. Six crisis archetypes, a structured response protocol, do's and don'ts, and field-tested lessons for rapid response across search and AI answer engines.
6 Phases
Structured first-48-hours response protocol
6 Archetypes
Distinct crisis types and how they differ
Field-Tested
Lessons drawn from real engagements
From the editors. This playbook is the operational framework we use to contain reputation crises. It is built around a single principle: the decisions made in the first hours determine whether a crisis is contained or amplified. We share it openly because the patterns are consistent — and because the most damaging errors are always preventable.
Six Crisis Archetypes & How They Differ
Not all reputation crises are the same — and the single most common strategic error is treating them as if they were. A planted news story, a bot amplification, and a deepfake each require a fundamentally different response posture. Diagnose before you deploy.
Planted Negative News Story
A negative article — often sourced from a competitor, short-seller, or coordinated operative — is placed in a credible publication and then amplified.
Key Risk
The credibility of the publication lends weight to the claims, making takedown harder and amplification easier.
First Move
Engage the publication's editor with factual corrections and documented evidence. Do not attack the journalist.
Bot-Amplified Smear Campaign
A claim — true, distorted, or fabricated — is seeded and then amplified by coordinated networks of accounts until it crosses the threshold of organic spread.
Key Risk
The amplification makes the claim appear to have organic consensus, which then attracts genuine media coverage.
First Move
Map the amplification network and escalate to platform trust-and-safety teams with network-pattern evidence.
Deepfake or Synthetic Media Attack
AI-generated video, audio, or images depict the target doing or saying something fabricated. Often timed to a sensitive moment (earnings, deal, election).
Key Risk
Visual 'evidence' is instinctively believed and shared faster than it can be debunked, even by sophisticated audiences.
First Move
Deploy forensic provenance analysis immediately and publish the authenticated original alongside the takedown request.
AI Answer-Engine Poisoning
False information has entered the source corpus of AI engines (ChatGPT, Gemini, Perplexity), which now confidently repeat it to anyone who asks about you.
Key Risk
The falsehood propagates silently — you may not know it's happening until a prospect or partner mentions it.
First Move
Run source-corpus analysis to identify the originating and amplifying sources, then deploy structured correction.
Legal or Regulatory Crisis
A lawsuit, investigation, or regulatory action becomes public, generating coverage and reputational fallout regardless of the underlying merits.
Key Risk
Legal constraints on what you can say publicly can make reputation defense appear like stonewalling.
First Move
Align legal and communications strategy so public statements are both legally safe and reputationally constructive.
Viral Negative Review / Social Post
A single negative review, tweet, or video goes viral — sometimes organically, sometimes amplified — and becomes the dominant narrative about your brand.
Key Risk
The virality attracts copycat posts and media coverage, creating a self-reinforcing negativity spiral.
First Move
Respond publicly with empathy and concrete resolution; suppress is the wrong instinct for genuine grievances.
The Six-Phase Crisis Response Protocol
This is the operational protocol we use to contain reputation crises. Each phase has a time window, a goal, and a specific failure mode. The order is not arbitrary — skipping evidence preservation, for example, destroys the legal leverage every later phase depends on.
0–1 Hour
1. Contain & Convene
1. Contain & Convene
Stop the bleed. Convene the crisis team, assign a single decision-maker, and freeze all non-essential outbound communications until the facts are established.
- Activate your crisis response team and designate a single authorized spokesperson.
- Issue an internal hold-statement: no public comments, no social posts, no speculative internal messages.
- Identify the origin, scope, and current reach of the attack — where it started, where it has spread, who has seen it.
Common Failure
The most common error in the first hour is reactive public comment. Speculation in minute 15 becomes the headline in hour 2 and the permanent record by day 3.
1–4 Hours
2. Preserve Evidence
2. Preserve Evidence
Before any content is removed, edited, or ages out, capture everything. Evidence you fail to preserve in the first hours cannot be recovered for legal or takedown use later.
- Screenshot and archive all instances: URLs, timestamps, engagement metrics, account profiles.
- Capture the original source and every amplifying node — media, social, forums, AI answer-engine outputs.
- Preserve chain-of-custody documentation for potential legal proceedings.
Common Failure
Attackers delete and edit their own content to erase trails. If you don't capture it before they do, the evidence is gone.
2–6 Hours
3. Assess & Map
3. Assess & Map
Determine the attack's nature, vectors, amplification mechanisms, and trajectory. Is it a planted story, a bot amplification, a deepfake, or AI answer-engine poisoning?
- Classify the attack pattern (see our negative PR attack pattern library).
- Map the amplification network — which accounts, platforms, and (if relevant) AI engines are spreading it.
- Assess the trajectory: is it accelerating, plateauing, or already self-sustaining?
Common Failure
Misclassifying an AI-amplified attack as ordinary bad press leads to search-suppression tactics that cannot touch the AI layer.
4–12 Hours
4. Hold Statement & Stakeholder Comms
4. Hold Statement & Stakeholder Comms
Issue a factual, proportionate holding statement to stakeholders, employees, and (if warranted) the public. Acknowledge awareness, state what you are doing, and commit to an update.
- Draft a holding statement that acknowledges the situation without confirming unverified claims or speculating on cause.
- Brief employees, investors, and key partners before they read about it secondhand.
- Set up a monitored channel for stakeholder questions.
Common Failure
Silence is not a strategy in an AI-accelerated crisis — the void fills with the attacker's narrative. But a premature, detailed response can amplify the claim.
12–48 Hours
5. Active Defense & Takedown
5. Active Defense & Takedown
Execute coordinated takedowns, legal escalation, and counter-narrative deployment across all identified vectors — simultaneously, not sequentially.
- Escalate takedown requests across all affected platforms with your preserved evidence.
- Deploy legal levers: defamation notices, DMCA for synthetic media, platform policy enforcement.
- Publish authoritative, verified counter-context that AI engines and journalists can retrieve.
Common Failure
Sequential takedowns let attackers migrate to new platforms. Coordinated, simultaneous escalation across all vectors is far more effective.
48 Hours+
6. Recovery & Hardening
6. Recovery & Hardening
Once the acute phase is contained, shift to long-term reputation recovery and structural hardening so the same attack pattern cannot recur.
- Launch sustained reputation-recovery content across search and AI answer engines.
- Conduct a post-mortem: what was the root cause, what worked, what failed, what must change.
- Build pre-positioned defenses: monitoring, authenticated media, and crisis protocols for next time.
Common Failure
Most teams stop after containment. The reputation damage often persists in search and AI results for months — recovery is a campaign, not an event.
In an active crisis, every minute matters. Our rapid-response team can be activated immediately to execute this protocol alongside your team.
Activate Rapid Response →Crisis Communication Do's & Don'ts
Distilled from real crisis responses, these are the decisions that most reliably determine whether a crisis is contained or amplified. The pattern is consistent: early, factual, coordinated response works; reactive, defensive, fragmented response makes things worse.
Do
- Acknowledge the situation early with a factual holding statement — silence lets the attacker's narrative fill the void.
- Preserve all evidence before requesting takedowns — you cannot recover what gets deleted or edited.
- Designate a single spokesperson so messaging is consistent and authorized.
- Brief stakeholders (employees, investors, partners) before they read about it elsewhere.
- Coordinate takedowns and legal escalation across all platforms simultaneously, not sequentially.
- Publish authoritative counter-context that journalists and AI engines can retrieve.
- Monitor AI answer engines (ChatGPT, Gemini, Perplexity) for how they are describing the situation.
Don't
- Don't speculate publicly about the cause before facts are verified — speculation becomes the permanent record.
- Don't attack the journalist, the platform, or the accuser personally — it amplifies the conflict and damages credibility.
- Don't issue a detailed denial before you have the facts — an inaccurate denial is worse than the original allegation.
- Don't treat an AI-amplified attack with search-only suppression tactics — the AI layer requires source-corpus correction.
- Don't go silent after the acute phase — unaddressed, damage persists in search and AI results for months.
- Don't assume the crisis is over when media coverage fades — AI engines continue surfacing it long after.
- Don't let legal constraints fully silence communications — coordinate legal and PR strategy so statements are both safe and constructive.
Crisis Response Lessons From the Field
Anonymized patterns drawn from real crisis engagements. Each illustrates a strategic decision that determined the outcome — for better or worse. The lessons are consistent across industries: early, factual, coordinated response works.
The Premature Denial
TechnologySituation: A viral post accused a company of a data breach. The company immediately issued a blanket denial calling the claim 'fabricated.' Two days later, internal investigation confirmed a limited breach had occurred.
What happened: The premature, categorical denial became the story. When the facts emerged, the company's credibility collapsed entirely — the breach itself was minor, but the cover-up perception was not.
Lesson
Never issue a categorical denial before facts are verified. A holding statement ('we are investigating and will share findings') is safer than an inaccurate denial.
The Coordinated Takedown
Financial ServicesSituation: A deepfake video of an executive appeared across four platforms simultaneously. The company had pre-positioned authenticated media and an evidence-preservation protocol.
What happened: Forensic analysis confirmed fabrication within 90 minutes. Takedowns were escalated across all four platforms simultaneously. The video never reached mainstream media traction.
Lesson
Pre-positioned defenses and simultaneous multi-platform escalation are decisive. Sequential takedowns would have let the video migrate faster than it could be removed.
The AI Layer They Missed
Professional ServicesSituation: A firm successfully suppressed a false article from Google search results but discovered months later that ChatGPT and Gemini were still confidently repeating the claim.
What happened: Traditional search suppression does not address the AI answer-engine layer. The firm had 'won' in Google but lost in the engines prospects actually use.
Lesson
Crisis response must include AI answer-engine monitoring and source-corpus correction from day one, not as an afterthought.
The Empathetic Recovery
Consumer BrandSituation: A viral negative review about a genuine product defect gained traction. The brand's first instinct was suppression — which amplified the backlash.
What happened: The brand reversed course, publicly acknowledged the defect, offered concrete remediation, and published the fix. The crisis converted into a trust-building moment.
Lesson
For genuine grievances, suppression is the wrong instinct. Empathetic acknowledgment with concrete resolution can convert a crisis into credibility.
Frequently Asked Questions
Expert answers to the most common questions about crisis communication and reputation recovery.
In a Crisis Right Now?
The first 48 hours are decisive. Our rapid-response team can execute this protocol alongside yours — preserving evidence, escalating takedowns, and protecting your reputation across search and AI.