Calling out a cyber crisis: a typology for cyber incident and crisis management

Abstract

Only a subset of cyber incidents in organizations escalates into a full-blown cyber crisis that overwhelms technical response capacities and has severe societal consequences. We clarify the transition from incident to crisis management and conceptualize escalation as a sociotechnical process shaped by sensemaking, decision-making, and multi-actor coordination. To do so, we synthesize cyber incident and cyber crisis management literature and propose a typology to illustrate the pressures and turning points in this transition based on actual cases. We discuss implications for preparedness, incident management, sensemaking, and post-incident learning that integrates technical remediation with crisis leadership and communication.