For the past several months, many of the cyberattacks FGS Global responded to started with a phone call. Cyber criminals posed as the help desk, called employees, and talked them into resetting a password or approving a login. Security tools didn’t catch it, because this comes down to human error, not a technology vulnerability. And AI has made it even more effective, allowing the threat actor to quickly pull key details to make their impersonations more convincing such as the name of their target's manager, where they live and work, and which software the company uses.
The risk is only amplified when employees are unaware: Companies are sometimes compromised a second time by the same threat actor, using the same social engineering playbook, within days of the first intrusion being detected.
Mitigating this threat starts by quickly alerting all employees that the company is being actively targeted, and clearly communicating how to respond should they encounter suspicious communications. Like all cyber response plans, this requires preparation and stakeholder mapping done well in advance.
Map stakeholders and messengers early
Establishing the capability to connect with all stakeholders at the appropriate time, on the right channel, and with advanced messaging and messengers is what distinguishes a mature incident response from a reactive approach that is ultimately less effective at protecting a company's reputation.
The company needs to identify exactly who their audiences are and who internally owns each relationship. That means defining specific stakeholder groups from employees to VIP clients, including those with contractual notification requirements. It also means mapping normal communication channels for each audience and deciding where proactive outreach is needed versus reactive. This groundwork also enables scenario planning that anticipates how an incident might unfold – so companies can stay ahead of the cyber crisis curve.
Employees should be explicitly included in the response playbook. The warning to staff should describe the tactic without confirming whether the company was actually compromised. It should come from the security team, or whoever normally sends cybersecurity communications. Keep it plain, leave out technical details that could help the attacker, and write it assuming it will leak, because internal messages often do. For example:
"Hackers are calling employees and pretending to be from IT. If someone calls asking you to reset a password or approve a login, hang up and contact the help desk using the number posted on the intranet. Then report the call to security."
Speed also matters. Threat actors often directly contact employees and even former employees – on work and personal accounts – with claims that the company has been breached. Advanced warning that threat actors are actively targeting the company positions employees to recognize the tactic and reduces the anxiety of being caught off guard.
The warning works best at companies where employees already know to hang up on a caller claiming to be a senior executive and check the request another way. That culture comes from what leaders say and reward long before an attack occurs.
Communicating with customers
Advanced scenario planning helps companies prepare for the difficult operational decisions they will have to make and explain.
When systems go offline during an incident, it is often because the company proactively shut them down to contain the attack and protect sensitive data. But companies sometimes fall into another reputational trap when they make this decision: a reluctance to say why. While it is fine to refer to the issue as a systems outage in early days/hours, this doesn’t hold water after an extended period and can create credibility problems for the organization.
If a company doesn't tell customers that the outage is a deliberate, protective step, customers may assume the hackers took the systems down. The reputational hit is worse when customers think hackers are in complete control. Taking credit for the outage means moving quickly to post a holding statement when systems go down, when possible, or creating a standalone site to communicate with stakeholders if the outage is expected to be prolonged. This enables the company to replace a narrative of helplessness with one of intentional, responsible defense.
Decide before the incident
Warnings and holding statements get stuck when the issue is first discussed in the middle of an incident, with legal, sales, comms and security teams weighing different risks. These hiccups can be minimized by keeping a cyber crisis communications playbook updated to reflect the most likely attacks a company may face, backed by comprehensive scenario planning for the different directions a crisis can go. These days that includes vishing attempts that impersonate help desk personnel, deepfakes, and supply chain attacks.
The companies that weather such attacks with the least reputational impact are those that pressure test these playbooks through cross-functional reviews and crisis simulations that include leaders from legal, sales and marketing, IT, and information security.
Draft the materials ahead of time, and decide who approves them and how they reach employees and customers. Email often isn't the best channel for staff, and a disabled website complicates customer alerts. Then test the process in a communications and risk focused tabletop exercise to see whether approval takes an hour or stalls overnight.
Balancing the need to move quickly against the discipline to wait for confirmed facts is more art than science, which is exactly why communications leaders can't be brought in after the fact. They need a standing seat on the incident response working group and a real role in preparation, long before any attack tests whether the balance holds.
Jim Finkle is a Managing Director in FGS Global's Strategy and Reputation practice and a senior leader in the firm's cybersecurity practice. He was formerly a communications director at Palo Alto Networks and cybersecurity and tech reporter with Reuters and Bloomberg News. He participated in the October 13 panel on "Incident Response: State of Play" at the October 13 Incident Response Forum West in Los Angeles.