The first hour is everything: what 63 years of crisis PR, and a career in covert operations, has taught us about keeping your head when the story breaks

A FOUR perspective, by Paul Hutton

There is a particular quality of silence that settles over a boardroom in the first few minutes of a crisis. I've seen it many times over the years. Phones have been put face down on the table. Someone is still holding the email that started it. The most senior person in the room is trying to look calm, and the most junior is trying not to catch anyone's eye. And somewhere in that silence, a decision is being made, usually badly, about what to do next.

My first career wasn't in public relations. It was in covert and specialist operations, where communications was not a department but a crucial tool, and by far the most effective weapon in the armoury. Every message carried weight. Every assumption had to be tested before anyone acted on it. The discipline drummed into us, the discipline of deep, rapid research, of full disclosure up the chain, of no nasty surprises, is the same discipline I've carried into 60+ years of crisis communications at FOUR. Because when the story breaks, the rules are remarkably similar: move fast, but move on verified ground.

This piece is for the business leader who has never been through a crisis and hopes they never will. It's also for the one who's been through one and knows, in the pit of their stomach, that they'll be through another. It covers the ten questions I'm asked most often. My answers are drawn from six decades of FOUR's collective experience and my own operational background spanning almost 30 years… As always, we'd rather be honest than flattering about this profession.

1. How do you define crisis PR in 2026, and has it fundamentally changed?

Crisis PR in 2026 is the discipline of protecting an organisation's reputation, revenue and relationships during any event that threatens its ability to operate normally. That's the textbook definition. The word ‘crisis’ is the problem, because it conjures images of oil spills and CEO resignations, often convincing most SME and mid-market leaders that it doesn't apply to them. It does.

A crisis today is far more democratic. It's a TikTok video of a mishandled customer complaint at a regional restaurant. It's a Glassdoor thread about a family-run manufacturer that gets picked up by a trade magazine. It's a local councillor tweeting about your planning application. It's a Subject Access Request from a former employee that arrives on a Friday afternoon. It's a ransomware note. It's a disgruntled contractor briefing a podcaster. Any of these can close a business, or shave a decade off its trajectory, if handled badly.

What has genuinely changed is three things.

First, speed. A story now reaches its audience before your legal team has finished its first cup of tea.

Second, asymmetry. A single individual with a phone and a grievance can command more attention than your corporate affairs department.

Third, permanence. Google has a long memory, and so does the Wayback Machine. The crisis you mishandle in April 2026 will still be the top search result when a journalist researches you in 2031.

So no, the fundamentals haven't changed - truth, speed, empathy and discipline still win. But the battlefield has. And the businesses that don't update their map get lost on it.

2. What's the biggest misconception businesses still have about crisis communications?

That it's about spin. It isn't, and anyone who tells you otherwise is selling you a product that stopped working around 2008. The modern media environment is too transparent, too networked and too aggressive for a clever line to rescue a bad set of facts.

Crisis communications is about the orderly release of truth, in the right sequence, to the right audiences, with the right context. It's about anticipating the questions you'll be asked tomorrow and making sure the answers you give today don't contradict them. It's about acknowledging harm where harm has occurred. It's about resisting the very human instinct to minimise, deflect and blame, an instinct that, untreated, accounts for the vast majority of crises that spiral.

The other misconception is that crisis PR is reactive. The best crisis work happens before anyone knows there's a problem: in the scenario planning, the media training, the stakeholder mapping, the message house, the dark site. By the time you're in the crisis, 80% of your outcome has already been decided by what you did, or didn't do, in peacetime.

3. What are the most common mistakes leadership teams make in the first 24 hours?

I keep a mental list. It's depressingly consistent.

•       Denying what is obviously true. This buys you perhaps two hours and costs you years.

•       Issuing a statement before the facts are in. Every subsequent correction becomes its own headline.

•       Hiding behind legal language. "We do not comment on ongoing matters" is not a strategy; it's an invitation.

•       Going silent. In the vacuum, others (ex-employees, activists, competitors, journalists) write your story for you.

•       Over-apologising before knowing what happened. This creates legal exposure and makes you look unserious.

•       Under-apologising when harm is clear. This is, by a distance, the more common mistake.

•       Defaulting to the CEO as spokesperson regardless of fit. Not every crisis needs the top of the house; some are made worse by it.

•       Treating internal and external communications as separate problems. Your employees read Twitter too, and they are often your most credible external voice, or your most damaging.

•       Forgetting the regulators, the investors, the customers, and the suppliers. The media is loud, but rarely the most important audience.

The single biggest mistake, though, is the failure to do the research. To establish, forensically, rapidly, honestly, what actually happened. Without that, every word you say afterwards is built on sand.

4. What separates businesses that recover quickly from those that don't?

Three things, in our experience at FOUR.

First, the speed and honesty of the initial acknowledgement. The businesses that recover fastest are the ones that say, within hours, some version of: here is what has happened, here is what we know, here is what we don't know yet, here is who is affected, here is what we are doing, and here is when we will update you next. They don't wait for perfect information. They commit to transparency about the imperfection.

Second, behavioural consistency. A crisis is a stress test of a company's stated values. Every internal memo, every customer service script, every executive LinkedIn post during a crisis is read against the grain of the public statement. If the public statement says "we put customers first" and the internal memo says "minimise refunds," it will leak, and it will catastrophically impact you.

Third, the willingness to change. Not just to say sorry, but to demonstrably do something different afterwards. New leadership. New processes. External review. Public reporting. The businesses that recover treat the crisis as the beginning of a reform, not the end of an inconvenience.

5. How has social media changed crisis response expectations and outcomes?

It has collapsed the timetable and democratised the microphone. Where once a newsroom ran a story through editorial review, fact-checking and a legal read, now a single user with 40,000 followers can reach a larger audience than a regional newspaper in under an hour, with no such filters.

For the crisis practitioner, this has three consequences. One, the holding statement must now go out in minutes, not hours, and it must go out on the channels where the conversation is actually happening.

Two, monitoring is no longer a luxury; it is the oxygen of the response. If you don't know what's trending about your brand in the first thirty minutes, you are already behind.

Three, the tone of crisis communications has had to become more human. The formal press statement, drafted in passive voice and signed "the company," now reads as tone-deaf. Audiences want a person, a name, a face, and a recognisable voice.

Social media has also raised the ceiling on what constitutes a ‘good’ recovery. A company that handles its crisis with transparency, empathy and speed can actually build long-term brand equity out of the experience. Equally, a company that mishandles it in public can't hide behind yesterday's newspaper. The record is permanent, searchable and screenshotted.

6. What role do misinformation and AI-generated content play in crises now?

A significant and growing one. In 2026, we are routinely advising clients on incidents where the precipitating event is not something they did but something that was fabricated about them. Deepfake audio of a CEO ‘admitting’ to fraud. AI-generated images of supposed product failures. Fake customer reviews produced at scale. Coordinated inauthentic networks amplifying a grievance to give it the appearance of organic outrage.

The playbook for this is different from a traditional crisis. With a genuine issue, your job is to acknowledge, explain and remediate. With a manufactured one, your job is to establish and prove the falsehood, quickly and with evidence and then decide carefully whether to engage or to starve the story of oxygen. Engaging amplifies; ignoring risks allows the lie to harden into ‘fact.’ That judgement call is one of the hardest in modern crisis PR; it is where deep, rapid research, the operational discipline I mentioned earlier, matters most. You cannot afford to refute something unless you are certain it is refutable.

We also counsel clients to pre-build evidentiary capacity now, in peacetime. That means controlling originals of executive video and audio, maintaining logs that can prove what was and wasn't said, establishing relationships with platforms and forensic partners and having a prepared response protocol for the moment someone releases a plausible fake. The organisations that will cope with this next wave are the ones preparing for it today.

7. What should every business have in place before a crisis hits?

•       A crisis playbook, current to within the last 12 months, that names individuals, not just roles.

•       A chain of command that works when the CEO is on a flight, the GC is on holiday, and it's a bank holiday Monday.

•       A stakeholder map covering employees, customers, investors, regulators, suppliers, partners and media, with named owners.

•       Pre-drafted holding statements for the 8 to 12 most likely scenarios, legally reviewed and ready to adapt.

•       A dark site or prepared landing page that can go live within the hour.

•       Media-trained spokespeople at two levels of the organisation, not just the CEO.

•       A 24/7 monitoring capability covering traditional and social media in the relevant languages and regions.

•       A relationship with a crisis PR firm that already knows your business, not one you have to brief from scratch at 3 am.

•       An agreed internal communications protocol so employees hear from you first, not from the news.

•       A well-rehearsed simulation, at least annually, that stress-tests all of the above.

8. What's one thing most companies don't prepare for, but should?

Their own people. The vast majority of crisis preparation focuses on external audiences: media, customers, regulators, and shareholders. But in 90% of the crises we advise on, the first leak, the most damaging quote, the screenshot that goes viral, comes from an employee or former employee. Either because they're genuinely aggrieved, or because they feel uninformed, or simply because they want to be the first to tell their network what's happening.

Companies under-invest in internal communications as a crisis discipline. They assume that if they treat staff well in peacetime, staff will be loyal in wartime. The evidence doesn't support that. Loyalty in a crisis is earned in the first two hours: by the speed, honesty and humanity of the internal message, by the visible presence of leadership and by giving employees a clear answer to the question every one of them is being asked by friends, family and customers: "what's going on at your place?"

Prepare your people. They are either your best ambassadors or your most effective critics, and which one they become is, to a surprising degree, up to you.

9. Can every business recover, or are some crises impossible to come back from?

Most businesses can recover from most crises. But there are three categories where recovery is genuinely difficult or impossible.

The first is safeguarding failures, particularly involving children or vulnerable adults, where there has been an institutional cover-up. Public tolerance here is, rightly, close to zero, and the regulatory and legal consequences typically overwhelm any communications strategy.

The second is serial deception. A single mistake, handled with honesty, is almost always recoverable. A pattern of deception, exposed over time, destroys the underlying trust premise that a brand relies on. At that point, the issue is no longer communications; it is the fundamental viability of the promise the business is making.

The third is crises where the business's purpose and its offence are inseparable. A food brand with a fatal contamination event in its flagship product, a financial advisor convicted of defrauding their own clients, and a charity found to be misusing donations. These aren't crises that can be reframed; they go to the heart of what the organisation exists to do.

Everything else (operational failure, leadership scandal, cyber breach, product defect, regulatory breach, activist attack) is survivable with the right response. It may take years. It may require new leadership, new ownership, and new branding. But recovery is almost always possible for an organisation that chooses truth, speed and humility over denial.

10. What separates good crisis PR from great crisis PR?

Good crisis PR manages the story. Great crisis PR changes the trajectory of the business.

Good crisis PR gets the statement out on time, handles the media calls, minimises the damage in the headlines and helps the leadership team sleep at night. That's a valuable service, and most of the industry is capable of delivering it competently.

Great crisis PR does something more. It uses the crisis as an accelerant for reform. It identifies the cultural or operational failure that produced the incident and pushes the organisation to address it, not because that's good spin, but because it's the only durable answer. It protects reputation in the short term by protecting integrity in the long term. It tells the client things they don't want to hear, at the moment they don't want to hear them, because the alternative is a worse conversation in six months.

Great crisis PR also carries with it an operational discipline that I first learned in a very different context. Rapid research before commitment. Full disclosure before action. No nasty surprises. The conviction that a clear, robust, evidence-based position, held steadily and delivered with humanity, will always outlast a clever one. That is the philosophy FOUR has operated on for 63 years, and is the reason, we like to think, that we're still here.

When your crisis comes (and in 2026, it's a question of when), the team you call should bring three things: the experience to have seen this before, the discipline to research before they speak, and the candour to tell you the truth when everyone else in the room wants to hear something softer. That's the job. That's the standard. And that's the difference.

Paul Hutton, CEO - FOUR