A cyber attack in 2016 was a 72-hour communications crisis. The breach happened. The company disclosed. Reporters wrote. The stock dipped. Sentiment recovered over the following quarters. Most companies that handled the disclosure window competently saw the news cycle close and the corporate narrative reset within twelve to eighteen months.
A cyber attack in 2026 is not a 72-hour communications crisis. It is a multi-year engine-cycle event. AI Communications as a discipline frames the cyber crisis as a multi-year corpus event, not a news-cycle event.
What changed
The AI engines now retrieve breach disclosures, victim notifications, regulator filings, and tier-one press coverage into the corpus they use to answer questions about the company. Every buyer who queries the engines about the company — every investor, every regulator, every reporter, every prospective hire — gets the breach surfaced as part of the brand portrait. The disclosure that closed the news cycle in 2016 anchors the engine cycle in 2026.
The $266 billion crisis communications research measured this directly. Companies that experienced anchor crisis events — including cyber breaches — saw the engine corpus persistently render the crisis years after the news cycle closed.
The new cyber crisis communications stack
Pre-incident corpus build. Companies need substantive primary-source corpus on cybersecurity practices, security posture, and incident response capability published BEFORE an incident occurs. The corpus competes with breach material in retrieval after an incident. Companies with thin pre-incident security corpora get rendered by the engines using the breach material itself.
Disclosure narrative that compounds. The disclosure statement matters across both clocks. The news-cycle version optimizes for clarity, regulatory compliance, and reporter pickup. The engine-cycle version — usually the same artifact — has to be structured so the engines retrieve the company's framing, not the adversary's framing or the reporter's framing.
Founder voice during recovery. Founder-direct communications during the post-disclosure window compound in the engine corpus as primary-source material the engines retrieve when generating future answers about the company. The collapse of press-coverage-as-authority is the structural reason founder voice matters more during recovery than it did in 2016.
Sustained displacement publishing. Twelve to eighteen months after the incident, the company should be publishing high-quality primary-source security content on a sustained cadence. The corpus competes with the breach material in retrieval. The displacement is multi-year work.
Entity infrastructure refresh. Wikipedia, Crunchbase, security trade publications, founder bios. Every entity surface needs the company's framing of the incident — short, accurate, and accompanied by the corpus that demonstrates the company's security posture going forward.
What the 2016 playbook still gets right
The disclosure window mechanics. The need for legal-communications alignment. The CISO-CEO communications protocol. The notification cascade for affected customers and regulators. None of this changed. All of it now sits inside a multi-year engine-cycle response instead of a finite news-cycle response.
The 5W research program measures the engine-cycle consequence of cyber incidents directly. Everything-PR tracks the discipline as it forms. The communications operator running the 2016 cyber crisis playbook in 2026 is operating across half the dashboard.
Originally published May 2016. Cleaned up and republished June 2026.
Ronn Torossian is the founder and chairman of 5W AI Communications, the AI Communications Firm. He is the publisher of Everything-PR and the author of two best-selling editions of For Immediate Release.