Packing for Snakes

In May 2026, the Institute for Public Relations published Dr. W. Timothy Coombs's updated report, Reexamining Crisis Communication. It’s the third version of a paper he first wrote in 2007, which I studied in graduate school, and it remains one of the most practical summaries of crisis communication research available today. I recommend it to anyone who manages incidents for a living (or comments about them publicly on the internet).

Coombs opens by distinguishing risk from crisis with a simple image. Hiking in a forest with venomous snakes carries the risk of being bitten. If you are bitten, now you have a crisis, but until/unless that happens, you simply have the potential for harm. According to Coombs, a crisis is that risk realized.

It’s a clear illustration and the right place to start. However, for security and privacy communications, I think the analogy needs another step because a snake bite is not automatically a crisis. Whether it becomes one depends on a few more things: whether the snake is venomous, whether you brought (& know how to use) first aid, and whether you can quickly reach medical care. That distinction matters because of how different organizations prepare. I see many organizations labeling nearly every incident a crisis, not because every incident is objectively severe from a technical or impact point of view, but because they’re unprepared, and being unprepared has a way of turning ordinary incidents into emergencies.

The bite isn't the crisis

Coombs's own definition supports this interpretation to a certain extent. In his most recent report, he defines a crisis as a disruption: "A crisis disrupts an organization's strategy, its relationship with its stakeholders, and potentially its operations."

By that standard, a bite that routine first aid handles is not a crisis. The organization's strategy doesn’t change, relationships hold, and operations continue. The bite is an incident, and it doesn’t need escalation. In fact, security teams handle incidents like this all the time, including bug bounty reports from external researchers, vulnerabilities found internally during code review, or limited spikes in ATOs. If you can quickly scope and resolve them, they don’t need to disrupt anything.

They only become crises when the response goes wrong, such as when leadership panics and pulls every senior person into a war room, setting aside the week's priorities. Coombs describes a version of this in his report – a response so poor it became a crisis of its own. I’m sure we could all cite an example where the incident didn’t disrupt our organizations as much as the organization disrupted itself.

Organizations prepared to encounter snakes on every hike find that most encounters are uneventful. Whereas those that merely hope that they won’t meet a snake end up facing an emergency around every corner. 

Investments in prevention and readiness often lose out to work that feels more productive. So the business essentially walks into the forest in sandals, without a first aid kit, and without knowing which snakes are truly dangerous. When one appears, every option is improvised and every decision escalates. It’s a crisis by default, and it’s a choice.

The most prepared organizations I’ve worked with treat snakes as a normal feature of the forest because when we expect them, an encounter is no longer a surprise. And because we know which species are actually dangerous, we’re not wasting time, energy, or resources on treating a harmless one as a fatal threat. To continue the analogy (don’t worry, it’s almost over), we carry exactly what we need on every hike, so bites get treated quickly and appropriately, rather than always becoming expensive distractions. 

Coombs names this gap in his discussion of the READINESS model, pointing out that only about half of organizations with a crisis plan and a crisis team actually test them through training. Those organizations may feel prepared, but they are not ready. At Discernible, we believe readiness should go well beyond training. As we argued in The Sawtooth Problem, security communication is not an exception state that switches on when an incident occurs. Incident response procedures should mirror day-to-day operations as closely as possible, so the relationships, channels, and decisions an incident depends on are ones the team already uses every day. It’s the difference between having a first aid kit and knowing how to use it without stopping to think.

What always-in-crisis mode teaches

When every incident is treated as a crisis, the organization conditions everyone around it to see security as a topic (and company function) that’s always in crisis. Heroics get rewarded and prevention goes unnoticed. Over time, adrenaline becomes the way work gets done. In his report, Coombs cites research on the trauma crisis teams absorb from their work, and a team in constant crisis mode never gets the recovery time that research says it needs.

Moreover, executives learn that security only matters to them when something is on fire. They come to associate security with threat and cost rather than capability and opportunity. They fund it reactively, after incidents, instead of steadily and at pace with the threats. Eventually they either panic on cue or stop listening. Meanwhile, employees learn to tune out alarms. Every urgent message about a security issue competes with the last one, and the last one turned out fine.

External stakeholders draw their own conclusions about a company that always sounds alarmed. Coombs's research shows that organizations with a history of crises are assigned more responsibility for the next one. I would add that an organization that handles every incident publicly as a crisis may be building that history one incident at a time. 

This argument can be misread as a case for downplaying incidents, but Coombs is clear that minimization tends to do more harm than good, and I agree. Telling people their lived experience isn’t real or doesn’t matter is one of the fastest ways to turn an incident into a crisis. The distinction is between normalizing readiness and normalizing harm. A prepared organization still takes every incident seriously, investigating, telling affected people what they need to know, and fixing what failed. What changes is the frequency and emotional register of each communication. The prepared organization doesn’t panic, or pull the whole company off course because of something its people are ready to handle.

Fewer snakes, fewer bites

Much of our work focuses on the part of this story that crisis communication research covers least since existing research is mostly about managing the bite. But effective security communication also influences how many and what kind of snakes are in the forest to begin with. It shapes whether engineers feel safe reporting a problem early, whether security can make the case for fixing a known flaw before a product release, and whether researchers trust you enough to report privately.

Security leaders could do a better job articulating to the business that the goal isn’t a forest with no snakes (this is neither possible nor necessary). Instead, the goal is to develop a team that expects snakes, knows which ones matter, and carries what it needs on every hike. Organizations that prepare this way have fewer crises, and not because they meet fewer snakes. They have fewer crises because their encounters stop escalating.