The phone rings at 6:14 on a Tuesday morning. A reporter at a tier-one publication has a draft live in their CMS, headline already pulled. They want a comment by 8am. The story is mostly accurate, partly speculative, and on the wrong side of the line that protects the company you have spent eight years building.
The sixty minutes that follow shape most of what is going to happen next.
Crisis comms is one of the few PR disciplines where speed and judgement compound. Get the first hour right and the second-day story is recoverable. Get it wrong and the trade press follow-ups will misframe the company for the next twelve months. Here is the playbook we run inside Beachhut when a story breaks.
The most common mistake is to start drafting a statement in the first five minutes. The team has not yet established what is actually true. A statement written without that ground is one you will retract by lunchtime.
What happens instead:
The middle thirty minutes are where the senior team makes the choices that travel. Three things happen in parallel.
Most company-side crises hinge on a small number of factual assertions. Whether the breach reached production data. Whether the founder departure was performance or principle. Whether the leaked acquisition price is accurate. Each of these has to be tested with the team that actually knows the answer. We use a structured questioning pattern to avoid soft-spoken qualifications that we will regret in print.
Every crisis story has a frame. The reporter is going to use one of three or four frames available; we cannot change that. We can heavily influence which one becomes dominant. The frame choice is rarely between "good for us" and "bad for us"; it is between two flavours of difficult. A data incident framed as "security maturity" lands differently from one framed as "negligence", even when the underlying facts are identical. The framing has to be defensible, not flattering.
Default to the CEO for material crises. Default to the CTO or Head of Security for technical incidents. Almost never default to an unnamed spokesperson in B2B technology; reporters read "a spokesperson said" as deflection. The voice the company speaks with in the first hour is the one journalists will quote for the next week.
The first holding statement is read more than the company's website that week. Treat it like a product, not a press release.
The senior team has the facts pinned, the frame chosen, the spokesperson confirmed. The holding statement gets written. We follow a four-block structure that has worked across roughly forty crisis engagements.
Two sentences that name what has happened in plain terms. Do not minimise. Do not exaggerate. The acknowledgement decides whether the rest of the statement is taken seriously.
What the company has done already, framed in the perfect tense. "We have suspended affected accounts." "We have notified the relevant authorities." "We have engaged an external firm to lead the review." Present tense ("we are doing") is weaker than past tense ("we have done").
What the company will do next, with timelines tight enough to be credible. Avoid the empty-calorie commitments ("we will continue to work hard"). Use specifics: "We will publish an interim report within seven days. We will brief affected customers individually before the close of business today."
How customers, press, and affected stakeholders reach the company. Different channels for each. Press goes to a named senior contact, not a press@ inbox.
The pattern adapts. Three quick illustrations:
A SaaS company learns mid-morning that an authentication endpoint has been exfiltrating session tokens for an estimated nine days. The first hour: security confirms the scope and severity, legal confirms regulatory obligations (GDPR for EU users, NIS2 for some jurisdictions), product confirms a fix is deployed. Frame: maturity, not negligence. Spokesperson: the CTO, with the CEO available for follow-up. Block 1 names "a security incident affecting session tokens"; block 2 confirms forced re-authentication has already shipped; block 3 commits to a post-mortem within ten days. The Financial Times' coverage of similar incidents shows the difference clear acknowledgement makes (see the FT's tech-incident archive for a benchmark of how these stories settle).
A trade publication has confirmed an acquisition price from two separate sources twelve days before the planned announcement. The first hour: confirm the figure with the deal team, confirm whether the regulatory filing supports or contradicts, decide whether to confirm-deny-or-decline. Frame: the deal is still pending; commenting in detail risks the process. Block 1 acknowledges that "a transaction is under discussion" without confirming the figure. Block 3 commits to a full statement upon completion.
The CTO leaves abruptly after eighteen months. A reporter has it from two sources at the company. The first hour: legal confirms what the exit terms say can be said, the board confirms the public framing, the remaining executive team confirms the interim plan. Frame: continuity, not chaos. Block 1 confirms the departure plainly. Block 2 names the interim leadership and the search process. Block 3 commits to a substantive update within three weeks.
Even if the first hour goes perfectly, the next five hours bring a tougher set of choices. The customer letter has to ship. The board has to be briefed. The team needs to hear from leadership directly. Each of these has a window measured in hours, not days, before the absence of communication becomes its own story.
This is the work the Beachhut crisis team runs from minute zero, but planning it in advance is what separates a recoverable incident from one that defines the company. If you have not already run a crisis simulation in the last twelve months, that is what to do this quarter.
The first hour is mostly about restraint, not action. Pin the facts, choose the frame, write the statement, then send. The agencies that win in crisis comms are the ones whose senior people are on the call within five minutes and whose statements never get retracted by lunchtime.
When should a company put a crisis comms agency on retainer?
Once you handle production data for paying customers, hold sensitive employee information, or trade publicly. The retainer cost is small compared to the cost of finding an agency at 7am on a Tuesday when a story has already gone live.
Should the CEO speak to the press during a crisis?
For material crises, yes. The single biggest unforced error in B2B crisis comms is hiding the CEO behind an unnamed spokesperson. Reporters read it as deflection and the framing hardens against you.
How long should a holding statement be?
Four short paragraphs. Acknowledgement, action, commitment, contact. Anything longer reads as defensive; anything shorter reads as evasive.
If a story is already live and inaccurate, can it be corrected?
Often, yes. Tier-one reporters will issue corrections when the facts are demonstrably wrong, especially in the first six hours. The window narrows fast. The agency's senior relationships matter more here than at any other moment in the year. If you are in a crisis now, here is the team to call →
Keep Reading
Five questions to ask in a pitch meeting and the red flags that look like green ones.
15 April 2026
Most founders call us 48 hours before close. Here's what six weeks actually buys you.
8 March 2026
The translation layer between what your engineers say and what buyers hear.
10 May 2026PR or comms crisis?
If you are in the middle of a live PR or comms incident, send us a note and a senior member of the team will come back to you as soon as possible.
Get in touch