Cyber Crisis Management: What to Do in First 48 Hours ?

When a serious cyberattack is confirmed, the clock becomes your main adversary. The window that follows detection determines how far the compromise spreads, how much remediation will cost and how your stakeholders will judge your handling of the situation. Cyber crisis management belongs to the whole executive team, not to the security function alone, because technical containment, legal exposure, client communication and business continuity all move at once and constantly constrain each other.

Most organizations discover this coordination problem during the incident itself, at the worst possible moment. What follows is the operational playbook we use at Sia for the first two days, structured by time window, with the arbitrations that matter at each stage and the place supervised AI agents occupy in a modern cyberattack response.

What Cyber Crisis Management Covers and Why the First Hours Decide the Outcome ?

A crisis is a governance state, not a severity score returned by a tool. That distinction drives everything that follows.

Security incident, cyberattack, cyber crisis

Not every alert deserves a crisis response. A security incident is any event that may affect the confidentiality, integrity or availability of your systems, and the vast majority are absorbed inside the security operations center without anyone outside ever hearing about them. A cyberattack becomes a cyber crisis when its operational impact, reputational exposure or regulatory implications exceed what standard incident response procedures can carry.

Four triggers deserve automatic crisis treatment. A ransomware crisis sits at the top, with production systems encrypted and an extortion clock running in parallel. Data exfiltration follows, since unauthorized extraction of customer or employee records immediately opens a notification question.

Privileged account compromise belongs in the same category, because administrator level access turns a local problem into a systemic one. Supply chain intrusion through a trusted provider closes the list, as your visibility over the attack path is partial by construction.

Qualification remains a human decision, taken by named people against pre-agreed criteria. A single compromised laptop rarely justifies it. Encryption spreading across critical servers always does.

Why 48 hours, and not a week ?

Cyber crises compound. Every hour of delay in containment widens the compromised perimeter, and an attacker moving laterally for a day can reach your backups, exfiltrate more data and destroy the evidence you will need for forensics, insurance and regulatory filings.

Regulation adds its own pressure. Under the GDPR, a personal data breach must be notified to the supervisory authority within 72 hours of becoming aware of it, and NIS2 imposes comparable duties on essential entities. Your credibility with clients, partners and insurers is built or lost inside that same window.

Where an AI agent earns its place in a crisis cell

During an attack, the crisis cell drowns in fragmented signals: SOC alerts, business impact reports, legal questions and client queries, all arriving out of order. The scarce resource is a single, continuously updated picture of what is confirmed and what remains hypothesis.

This is the gap the Crisis Companion agent is designed to close. It consolidates technical and business signals into one situation view, surfaces the applicable playbook section for the scenario in progress, maintains a time stamped log of every decision and every action taken, and prepares first drafts of internal messages, external statements and regulatory notification elements. Qualification of the incident, arbitrations between containment and continuity, and any declaration to a third party stay with the humans who carry the accountability.

Its main contribution is native traceability. Logging is the first discipline teams abandon under pressure and the first thing regulators, insurers and auditors ask for afterwards. An agent that records the decision trail as it happens, including options considered and rejected, gives you evidence and a usable post-mortem rather than a reconstruction from memory three weeks later.

Hour 0 to Hour 4: Confirming the Attack and Activating the Cyber Crisis Cell

The opening window is about qualification, not heroics. Acting fast on the wrong diagnosis costs more than four calm hours of verification.

Confirming the incident is real

Before escalating anything, validate the alert against at least two independent sources. False positives from the SOC, the EDR or the SIEM are frequent, and launching a full crisis response on a phantom event burns credibility you will need for the real one.

Once the signal holds, characterize the attack. Identify the likely type, whether encryption, exfiltration or account takeover, then map the systems potentially affected and rank them by business criticality. From that picture, judge whether standard incident response is enough or whether crisis governance applies. Writing those criteria down before the incident turns a debate into a decision.

Activating the cyber crisis cell

A functional cyber crisis cell brings together the CISO and IT leadership for the technical dimension, legal counsel for regulatory and contractual exposure, communication for messaging, executive leadership for decision authority, and human resources when employees are affected. Each seat covers a risk no other seat can cover.

Our position is firm: rely on a small, pre-identified cell rather than improvising its membership under pressure. Assembling a team from scratch during an active attack wastes hours and creates decision gaps when authority must be unambiguous.

Establish an out-of-band communication channel at the same time, since coordinating the response over a potentially compromised system hands your plans to the attacker. Mapping critical assets, testing fallback channels and maintaining readiness is where the Cyber Resilience Agent supports security teams between incidents, under the control of the people who own the resilience posture.

Isolating systems without destroying evidence

Isolation is an arbitration, not a reflex. Cutting a machine off the network stops propagation but can erase volatile memory and connection data that investigators need to establish the entry vector.

Weigh containment speed against evidence preservation according to the severity of the active threat. When encryption is spreading, containment wins without debate. Facing a quiet exfiltration, capturing memory before isolating produces a far better investigation.

Hour 4 to Hour 24: Containment, Investigation and First Communications

By the end of the first day, three workstreams run in parallel, and the crisis cell exists precisely to keep them synchronized.

Stopping propagation

Effective containment combines network segmentation, revocation of suspicious access, rotation of privileged credentials and blocking of known indicators of compromise. None of these actions is sufficient alone, and their sequencing matters more than their individual execution.

Hold a structured situation review every four hours. That rhythm forces the cell to separate what is confirmed from what is assumed, keeps pending decisions visible, and prevents the fragmented view that derails most responses around hour ten.

Running the forensic investigation

Forensic analysis answers the three questions that govern everything else: how the attacker got in, when, and how far they reached. Without the true extent of the compromise, you contain partially and reopen the crisis a week later.

Log correlation across millions of events is a legitimate use case for AI assistance. An agent with tool calling and retrieval over your own procedures narrows the search space and flags anomalies worth a human look, while conclusions remain the work of a qualified analyst. The guardrail stays explicit: the agent proposes, the investigator validates.

Data exposure deserves its own track, since the notification question depends on it. Determining which sensitive records sit inside the compromised perimeter is what the Sensitive Data Detector accelerates, with the legal qualification of that exposure staying with counsel.

Issuing the first internal and external messages

Communication splits into two audiences. Internally, employees need instructions and leadership needs status. Externally, clients, partners and sometimes the media need facts they can act on.

Our recommendation is a factual message, transparent about what is confirmed, with no speculation on causes or final scope. Prolonged silence carries the greater risk, since it feeds rumor and erodes trust faster than any technical detail ever could. Agent support helps produce consistent drafts at speed, provided a named human validates every word that leaves the organization.

Assessing notification obligations

Deadlines vary by jurisdiction, by sector and by the nature of the data involved, and insurance contracts often add clauses with shorter timing than regulation.

Hour 24 to Hour 48: Stabilization, Communication Rhythm and Recovery Planning

The second day is where impatience becomes the main threat. Pressure to restore service arrives long before eradication is actually confirmed.

Eradicating before restoring

Eradication means removing the attacker’s footholds, closing the exploited vulnerabilities and verifying that no persistence mechanism remains. Confirm all three before any system returns to production.

Restoring too early is the costliest mistake in cyberattack response. Reconnecting a compromised system reopens the door, restarts the crisis from a worse position and destroys whatever credibility your communication had built.

Holding a predictable update rhythm

Regularity matters as much as content. Publish updates on a fixed schedule, even when nothing significant has changed, because a predictable cadence signals control and denies speculation the vacuum it needs. Set up a dedicated contact point too, a hotline or an information page, so inbound questions stop consuming the crisis cell.

Sequencing the restoration

Restoration follows priorities. Rank systems by business criticality and residual compromise, then rebuild in a controlled sequence rather than all at once.

Never reconnect a system without cross validation between the technical teams and the crisis cell. Technical readiness is one input; the governance layer confirms that reconnecting this system, now, fits the wider recovery plan.

Documenting decisions as they are made

Traceability is not administrative overhead. Regulators, insurers and your own review will all rely on a clear record of what happened and why.

Beyond 48 Hours: Consolidating the Cyber Crisis Management Plan

A crisis produces one asset worth keeping: a precise understanding of where your organization actually breaks. Capture it while it is still uncomfortable.

Running a post-incident review

Look for root causes rather than visible symptoms. A phishing email that led to credential theft is a symptom, while the absence of multi-factor authentication on privileged accounts is a cause, and only the second one is worth fixing.

Evaluate the cell itself as rigorously as the technical response. Identify where decisions stalled, which information arrived too late and which role was structurally overloaded. Those answers usually explain most of the delay.

Updating the plan and testing it

A cyber crisis management plan that survives a real incident without being rewritten is a document nobody used. Feed the lessons back into procedures, simulation scenarios, detection rules and escalation criteria.

Schedule a simulation in the weeks following the incident, while the memory is sharp. An exercise run early cements the improvements and tests them before the next attacker does. Broader governance work, including formal assessment of how AI systems are used in sensitive processes, is supported by the Agent Impact Assessment, with risk acceptance remaining an executive decision.

Building resilience into the operating model

Resilience is built between crises, never during one. Our experience with crisis setups points to the same conclusion each time: the differentiator is not the model powering your tools but the agentic layer around it, meaning the orchestration, the memory of past incidents, the workflows and the business logic that encode how your organization actually decides.

That layer is also where governance belongs. Decision rights, escalation thresholds, traceability and human validation points must be designed in from the start, because auditability added after an incident is reconstruction, not evidence. At Sia, we treat crisis capability as a production system with named accountabilities, not as tools tested once and archived.

FAQ

What is cyber crisis management ?

Cyber crisis management is the organizational response activated when a cyberattack exceeds what routine incident handling can absorb. It coordinates technical containment, legal obligations, communication and executive decision making within a single governance structure, with defined roles, escalation criteria and a documented decision trail.

What is the difference between a cyber crisis and a security incident ?

A security incident is any event affecting the confidentiality, integrity or availability of systems, and most are resolved entirely by the security team. A crisis begins when operational impact, reputational risk or regulatory exposure requires decisions beyond that function. The threshold comes from governance criteria agreed in advance, not from a tool’s severity rating.

Who should be in a cyber crisis management team ?

A cyber crisis cell brings together the CISO and IT leadership, legal counsel, communication, executive leadership with real decision authority, and human resources when employees are affected. Keep it small and pre-identified, name a deputy for every seat, and ensure the group is reachable through a channel independent from the potentially compromised information system.

How to build a cyber crisis management plan ?

Start from your critical business processes rather than your technical inventory, and define the scenarios that would genuinely disrupt them. Then set your qualification criteria, name the cell and its deputies, and document escalation paths, communication templates, notification obligations and what gets logged by whom. Finally, test the plan through realistic simulations and rewrite it after every exercise.

How long does it take to recover from a ransomware attack ?

Technical restoration of critical systems typically spans days to several weeks, depending on backup quality, the extent of the encryption and whether eradication was confirmed before reconnection. Full recovery, including client relationships and process changes, runs over months. Organizations with tested, isolated backups and a rehearsed plan recover faster than those improvising the sequence.

The first 48 hours reward preparation far more than talent. Teams that perform well in a cyber crisis are rarely the ones with the best tools; they are the ones who already know who decides what, through which channel, and against which criteria, before the first alert fires.

Assessing your own maturity honestly is the useful next step. Map your crisis cell, test your out-of-band channel, and examine how supervised agents could strengthen signal consolidation, traceability and communication under pressure, while decisions stay where accountability sits. Our Insights cover the wider agentic transformation this capability belongs to.