WeichertMehner: Cyber Crises Are Decision-Making Crises

The greatest cyber risk lies not solely in the attack itself

In 2026, cyberattacks will top the Allianz Risk Barometer for the fifth consecutive year. 42 percent of the risk experts surveyed cite cyber incidents as one of the most significant business risks. Artificial intelligence follows in second place with 32 percent. In Germany, cyberattacks and business interruptions remain the two leading risks. The results illustrate just how closely digital dependence and corporate vulnerability are now intertwined.

The European Union Agency for Cybersecurity (ENISA) also describes an increasingly complex threat landscape in its Threat Landscape Report. Ransomware remains the form of attack with the most immediate consequences. Geopolitical conflicts, attacks on digital dependencies, and the misuse of artificial intelligence exacerbate these risks.

Nevertheless, public discussion often focuses on attack methods, security vulnerabilities, and technical countermeasures. This perspective falls short. A cyberattack does not become a corporate crisis simply because systems fail. It becomes a corporate crisis when the organization is no longer able to function due to uncertainty.

A production shutdown jeopardizes delivery commitments. A data breach calls into question the trust of customers and business partners. Manipulated information can undermine the reliability of business decisions. A compromised service provider can disrupt entire value chains.

The technical incident is merely the trigger. Its economic impact also depends on how quickly and resiliently a company makes decisions, how it assumes responsibility, and how it interacts with its stakeholders. This brings a previously often-underestimated dimension of cyber resilience into focus: the ability to translate technical uncertainty into business decisions.

Cyber Risks Are Changing the Requirements for Corporate Governance

A cyber incident creates an unusual decision-making situation. Time to respond is limited, while the information available remains incomplete. Technical experts work to investigate the incident. Legal departments assess regulatory and liability-related consequences. Operational units organize the maintenance of business operations.

At the same time, employees, customers, suppliers, insurers, and, where applicable, investors or regulatory authorities need reliable information. The needs of these stakeholders differ fundamentally. Customers are concerned with the availability of services and the protection of their data. Employees need guidance and clear instructions on how to proceed. Investors assess potential consequences for revenue, liquidity, and enterprise value. Regulatory authorities expect timely and transparent reporting. These interests cannot be addressed by a single communication message.

The example of European cyber regulation illustrates the time pressure involved. The NIS2 Directive and the German BSI Act generally require affected organizations to submit an initial report within 24 hours and a follow-up report within 72 hours in the event of significant security incidents. The specific application depends on the legal classification of the company and the incident.

This means that the critical phase of crisis management begins even before a final technical assessment has been completed. Companies must make decisions even though essential information is still missing. For executive boards, this creates a new governance requirement. Not every uncertainty can be resolved before a decision is made. It is therefore crucial to determine what information is required for which decision, who bears responsibility, and when decisions must be reviewed.

Technical cyber resilience requires a second level

Cybersecurity strategies rightly focus on prevention, detection, containment, and recovery. Without these capabilities, robust resilience is not possible. However, technical preparedness alone does not address how a company deals with the consequences of a cyber incident in relation to its economic and social environment.

This requires a second level, closely linked to technical incident response: a company-wide decision-making and communication architecture. At its core, this involves four capabilities.

• First, a shared understanding of the situation must be established. Technical findings, operational impacts, and stakeholder reactions must be consolidated into a consistent situational picture. Confirmed facts must be distinguished from assumptions and open questions. Only then can executives make decisions whose rationale remains transparent.
• Second, companies need clear decision-making authority. Who decides to notify customers? Who is responsible for public statements? Which decisions are coordinated among the CISO, General Counsel, CEO, and CCO? Unclear responsibilities lead to delays and contradictory measures.
• Third, stakeholder reactions must be anticipated. The timing and quality of information influence how customers, regulatory authorities, employees, and business partners assess the incident. Stakeholder management thus becomes an operational discipline of crisis management.
• Fourth, the organization needs the ability to continuously adapt decisions. New forensic findings can alter earlier assessments. Communication processes must therefore be able to handle a dynamic set of facts without losing credibility.

We call this capability “decision readiness.” It refers to the systematic preparation of organizations to make decisions under conditions of uncertainty, time pressure, and high stakeholder exposure. In the context of cyber risks, “Decision Readiness” means organizing technical incident response, management decisions, and strategic communication as an integrated process.

Economic damage extends beyond IT

The economic significance of this perspective is considerable. According to IBM’s 2026 Cost of a Data Breach Report, the average cost of a data breach worldwide was approximately five million U.S. dollars. For Germany, IBM cites an average of 4.25 million euros. These figures are study averages and not forecasts for individual companies.

Nevertheless, they demonstrate why cyber risks cannot be meaningfully limited to IT budgets. The economic consequences of an incident can extend far beyond technical recovery costs. Lost orders, disrupted customer relationships, contractual disputes, additional regulatory audits, and damage to an employer’s reputation can exacerbate the damage in the long term.

This dynamic is particularly relevant in industrial companies and critical value chains. If a supplier can no longer deliver, potential consequential costs may also arise for its customers. Economic exposure thus extends beyond the boundaries of the affected company. In this context, reputation is not merely a secondary issue of public perception. Trust influences whether customers continue business relationships, business partners demand additional safeguards, or stakeholders believe management is capable of restoring the company’s ability to act. Reputation is thus an economically relevant risk buffer.

This implies a different logic for evaluating strategic communication. Media coverage and tone alone are not decisive. It is equally important whether companies reach critical stakeholders in a timely manner, avoid contradictions, and stabilize economically relevant relationships. The actual value contribution cannot always be precisely isolated. However, it can be made transparent through appropriate indicators. These include the time to critical decisions, the quality of stakeholder information, at-risk customer relationships, and the duration of trust rebuilding.

The CCO’s role begins before the crisis

The consequences extend beyond traditional crisis communication. In a cyber crisis, the Chief Communications Officer (CCO) serves as the interface between technical intelligence, corporate leadership, and the external decision-making environment. His or her task is not merely to formulate approved information in an understandable way. The CCO must identify which uncertainties are relevant to the company’s reputation, which stakeholder reactions influence corporate options for action, and which decisions make effective communication possible in the first place.

This requires early involvement in crisis preparedness. The traditional separation between technical crisis plans and communication response plans carries the risk that critical interfaces will only be clarified once a crisis actually occurs. In a dynamic cyber crisis, this delay can prove costly. Companies therefore need joint exercises involving the executive board, CISO, CCO, legal department, and operational leadership.

Such simulations should not merely test whether a crisis management team can be activated or a press release approved. They must demonstrate whether the organization remains capable of making decisions even in the face of conflicting information, simultaneously escalating stakeholder demands, and incomplete technical findings. This establishes a different standard for preparedness. What matters is not just whether a crisis manual exists. What matters is whether its decision-making logic works under realistic pressure.

– – – – –

Related Links

👉 www.weichertmehner.com  

Photo: unsplash