Calling out a cyber crisis: a typology for cyber incident and crisis management

Hujanen, K.; Wolbers J; Berg, B. van den; Rizza, C.; Chauhan, A.; Matser, A.; Kox, J.; Treurniet, W.; Wolbers, J.

doi:doi:10.59297/a2tqhd09

Hujanen, K.; Wolbers J.; Berg, B. van den (2026)

Calling out a cyber crisis: a typology for cyber incident and crisis management

Only a subset of cyber incidents in organizations escalates into a full-blown cyber crisis that overwhelms technical response capacities and has severe societal consequences. We clarify the transition from incident to crisis management and conceptualize escalation as a sociotechnical process shaped by sensemaking, decision-making, and multi-actor coordination. To do so, we synthesize cyber incident and cyber crisis management literature and propose a typology to illustrate the pressures and turning points in this transition based on actual cases. We discuss implications for preparedness, incident management, sensemaking, and post-incident learning that integrates technical remediation with crisis leadership and communication.