Event wrap-up: Telum Talks To: The National

Historical data breaches are resurfacing in AI-generated answers when consumers evaluate whether to trust or purchase from an organisation, potentially extending their reputational impact long after the incidents have been resolved, according to a new report by Sefiani, part of Clarity Global.

The research, Cyber Breaches and Reputation Response in the AI Era, combined a nationally representative YouGov survey of 1,019 Australian adults, conducted between 19 and 24 August 2026, with an analysis of how three AI search tools reference historical cyber incidents across different stages of the customer journey.

Using its Surfacd AI visibility tool, Sefiani examined three organisations that had experienced significant data breaches: a global law firm, a global logistics company, and an Australian private health insurer. The analysis tested 30 prompts per organisation across ChatGPT, Google AI Mode, and Google AI Overviews.

The findings suggest that while consumers may be willing to remain with organisations following a data breach, the way a company communicates its response and subsequent improvements can have lasting reputational implications.

Breach visibility increases closer to purchase decisions

The study found that historical data breaches were rarely mentioned in AI-generated responses during the initial stages of customer research but became increasingly visible as queries shifted towards evaluating specific organisations.

During the category discovery stage, past breaches appeared in an average of 2.7 per cent of AI responses across the three organisations. This increased to 13.1 per cent during brand validation and 42.2 per cent at the decision stage, when users asked more directly about an organisation's trustworthiness.

For one organisation, breach history appeared in 59.1 per cent of decision-stage responses.

The research also found that AI responses did not exclusively frame historical breaches negatively. Some answers referenced how organisations restored services, improved security, or responded to incidents.

According to Sefiani, this means organisations need to consider how their handling of an incident continues to be represented publicly, even after the immediate crisis has been resolved.

Customer loyalty depends on the response

The YouGov survey found that 31 per cent of Australian respondents said they would stop using an organisation following a data breach, while 53 per cent said they might stop.

However, the research identified a gap between stated intentions and reported behaviour, suggesting that experiencing a data breach does not necessarily result in customers abandoning an organisation.

Among all respondents, 57 per cent had been customers of an organisation that experienced a breach. The report found that 13 per cent had moved to another provider, while 24 per cent considered leaving but stayed, and 20 per cent did not consider leaving.

When asked what would influence their decision to continue using a company following a breach, respondents identified measures taken to prevent another incident as the most important factor (39 per cent). This was followed by the seriousness of the breach (32 per cent), the type of customer information affected (32 per cent), transparent communications about what happened (30 per cent), and support offered to affected customers (29 per cent).

The study also tested how descriptions of an organisation's breach response in AI-generated answers could influence purchasing intentions.

When respondents were presented with a scenario in which AI reported that an organisation had been slow to notify customers and lacked transparency, 28 per cent said they would purchase from it. This increased to 57 per cent when the AI response described prompt customer notification, clear explanations, and practical support.

By comparison, 67 per cent said they would purchase from an organisation that was generally well reviewed, with no data breaches mentioned.

Where AI draws its information from

Sefiani also examined the information sources referenced by AI when generating answers about the three organisations.

Corporate content, including company websites and owned reports, appeared most frequently, referenced in 88 per cent of responses. Editorial media coverage followed at 61 per cent, while government and regulatory sources appeared in 55 per cent, and user-generated content, including social media, in 36 per cent.

The report noted that the source mix varied depending on the sector and the nature of the query.

These findings highlight the role of both owned communications and independent third-party information in shaping how AI presents an organisation's reputation.

According to Sefiani, organisations that stop communicating publicly once a breach has been resolved risk leaving AI tools to draw on historical media reports and other third-party commentary without access to an updated account of the company's response.

Sefiani's Managing Partner, Mandy Galmes, said organisations should consider what information remains publicly available after the immediate incident has passed.

"Once the incident is resolved, organisations need to publish a clear, factual account of what happened, what they did and, importantly, what they have changed, on their own channels. This means AI has your own version of the incident. If this step is missed, AI will build the story and define your reputation for you, from whatever media coverage or third party commentary appeared."

Updating the crisis communications playbook

The report argued that established cyber crisis communications practices, including timely disclosure, factual updates, and customer support, remain important but need to account for how AI tools retrieve information long after an incident.

It proposed five additional considerations for organisations managing cyber incidents:

• Publish a factual account of the incident and response: Maintain an accessible summary on owned channels outlining what happened, how customers were supported and what has changed to reduce the risk of recurrence.

• Engage with credible editorial media: Consider providing journalists with a factual account of the organisation's response, remediation and lessons learned to create an independent record.

• Maintain customer support beyond the immediate incident: Recognise that customer experiences may continue to influence reviews, social media discussions and other content used by AI.

• Share lessons with industry stakeholders: Work with industry bodies and peers to communicate relevant learnings that could support broader cyber preparedness.

• Monitor AI-generated responses over time: Assess how AI platforms describe the organisation before and after an incident, including which sources and narratives they reference.

Co-founder and CEO of NSB Cyber, Shane Bell, highlighted the importance of communications during the initial response.

"Good and bad cyber incidents used to come down purely to technical judgement. A bad incident is now more often than not one that was poorly communicated. Technology discussions tend to dominate the first 72 hours, when communications should be front and centre. Organisations that struggle are the ones least prepared to talk to the regulators, suppliers, partners and customers," he said.

What communications professionals need to know

The research suggests that the reputational consequences of cyber incidents may extend beyond the traditional news cycle, particularly as AI tools increasingly draw on historical information when responding to questions about organisational trustworthiness.

For PR and communications professionals, the findings point to the importance of maintaining an accurate, accessible record of an organisation's response and remediation, alongside continued engagement with customers and relevant stakeholders.

For media professionals, the study highlights the potential longer-term role of editorial coverage as a source of information in AI-generated assessments of organisations.

The findings also suggest that post-crisis communications should not be measured solely by the immediate public response. Monitoring how past incidents and subsequent corrective actions are represented across AI platforms may become another consideration in long-term reputation management.

IPO communications are becoming more complex as companies face a broader mix of institutional, retail, and international investors across increasingly fragmented media environments, according to a new report from NorthStar Insights. The report argues that while financial media, press releases, and investor roadshows remain important, companies also need to account for digital channels, different levels of financial knowledge, and market-specific expectations when preparing for a listing.

Earning the Market’s Trust: How Communication Strategies Are Shaping Modern IPO Success examines IPO communications across North America, North Africa, East Asia, India, and the Gulf Cooperation Council (GCC).

The September 2026 report draws on the firm's advisory work across five markets, including the GCC perspective authored by Arth Malani, with further perspectives from Senior Advisor Mark Jackson on Hong Kong, and Director Seth Gagahina on creative storytelling. Market contributions come from Pranav Kumar of Alkimyx Global, Richard Mahony of KRG Advisors, and Sara Gad of Moharram & Partners. The Chartered Institute of Public Relations (CIPR) backs the research, with contributions from its President, Farzana Baduel. 

Its central finding is that there is no single communications model that works across every IPO market. Investor profiles, media environments, regulation, and cultural expectations all influence how a company needs to communicate before and during a listing.

Retail participation is widening the IPO audience

The report cites estimates that retail investors account for around 20 to 35 per cent of daily equity trading volume in the US, UK, and South Korea, rising to around 40 to 50 per cent in India and Mainland China.

It also cites data showing that around 10 percentage points of US equity trading volume shifted from institutional to retail investors between 2010 and 2025.

According to the report, this means companies increasingly need to communicate their business models, growth strategies, competitive strengths, and long-term vision to investors with different levels of financial knowledge and different information needs.

Investor allocation structures can also differ significantly between markets. The report notes that retail investors typically receive around five to 10 per cent of IPO allocations in the US, while India's mainboard IPO framework requires a minimum 35 per cent reservation for retail individual investors in applicable offerings.

NorthStar Insights says these differences affect both the information companies provide and the channels they use to reach investors.

Digital channels are expanding alongside traditional financial communications

The report says financial media, analyst reports, press releases, and roadshows remain important, but now operate alongside social media, executive channels, podcasts, video, and other digital formats.

It cites US investor research showing that 75 per cent of investors rely on brokerage or investment firms for information, while 29 per cent report relying on social media. YouTube is used by 30 per cent of investors overall, and 61 per cent of investors under 35.

At the same time, only 40 per cent of investors surveyed said they were confident in their ability to assess the accuracy of financial information they encounter. NorthStar Insights says this makes clarity and accessibility increasingly important as IPO information reaches investors through a wider range of channels.

The report also cites academic research linking greater media exposure and online investor attention with IPO outcomes.

Companies receiving three or more pieces of media coverage in the month before their IPO had, on average, 206 per cent more analyst coverage and 127 per cent more institutional investors in their first year after listing than companies in the bottom third of media coverage. Separately, research cited in the report found that IPOs with high abnormal online search activity in the week before listing recorded average first-day returns of 17.64 per cent, compared with 11.73 per cent for IPOs with low search activity.

The report presents these studies as evidence of the relationship between the information environment, investor attention, and IPO outcomes.

IPO communications remain highly market-specific

NorthStar Insights says the expansion of communications channels has not produced a single global approach.

In North America, digital platforms are becoming more prominent alongside traditional financial media and investor communications. The report says this can help companies reach wider audiences, including retail investors, while also increasing the likelihood that company messages will be summarised, discussed, and redistributed outside official channels.

Morocco presents a different communications environment. The report says French is mainly used to communicate with local institutional investors, regulators, and business media, while English is used for international investors and regional funds. Direct engagement, including institutional roadshows, one-to-one meetings, and small-group briefings, also remains important.

In India, the report says the sizeable retail investor base has encouraged IPO-bound companies to use more accessible formats such as short explainers, podcasts, infographics, and dedicated microsites alongside formal IPO documents.

For mainland Chinese companies listing in Hong Kong, communications may need to address international institutional investors who are less familiar with the company and assessing it in a different regulatory and geopolitical environment.

What makes an IPO story credible differs by market

The report says companies need a clear and credible investment story that explains their business model, growth strategy, financial fundamentals, and long-term direction. However, the factors underpinning credibility differ depending on the company, market and investor group.

In North America, the report highlights clarity and simplicity when explaining complex businesses. It cites the 2026 IPO of AI infrastructure company Cerebras Systems, whose investment proposition focused on its AI infrastructure and relationships with OpenAI and AWS. The report notes that the offering priced above its range and was more than 20 times oversubscribed.

In Morocco, credibility for family-owned businesses can place greater emphasis on continuity, governance after listing, ownership structure and minority shareholder protection.

For newer companies in India, NorthStar Insights says IPO narratives have shifted towards financial performance and a path to profitability. It says more recent communications place greater emphasis on metrics such as positive cash flow, profitability, EBITDA expansion, and capital efficiency, with some companies beginning pre-IPO communications 12 to 18 months before filing their draft prospectus.

For mainland Chinese companies listing in Hong Kong, the report says communications need to build credibility with international investors while accounting for different regulatory environments and geopolitical scrutiny.

Cross-border communications require consistency and adaptation

NorthStar Insights identifies cross-border communication as another challenge for companies preparing to list. The report says companies need to maintain a consistent core investment story while adapting language, tone, and communications practices to different markets.

Cultural expectations, media environments and regulatory requirements can affect how the same message is interpreted. If investors and media receive or interpret different messages about a company, the report says this can create confusion and reputational risk.

The report points to Morocco's bilingual financial environment and mainland Chinese companies listing in Hong Kong as examples of how messages may need to be adapted for different domestic and international audiences without changing the underlying investment story.

Preparation needs to begin before the public phase

The CIPR contribution recommends identifying potential communications risks, difficult questions, and hostile narratives in advance. Monitoring, rapid-response and rebuttal arrangements should already be in place, with supporting facts, approved responses, and clear escalation routes available for high-stakes situations.

It also warns that communications teams can be under pressure for extended periods during IPOs and other high-stakes events, making adequate resourcing and access to decision-makers important.

NorthStar Insights says the objective is not simply to prepare material for the listing itself, but to build a communications approach that can continue once the company enters the public markets.

What communications professionals need to know

The report identifies consistency and adaptability as the central challenge for IPO communications. Companies need a clear investment story, but the way that story is communicated may need to change according to investor group, media environment, language, regulatory structure, and market.

Traditional financial communications remain important, but the report says they increasingly need to sit alongside digital and public-facing channels. The widening investor base also means complex business and financial information may need to be made accessible to audiences with different levels of financial knowledge.

NorthStar Insights also stresses that credibility is not built in the same way everywhere. Depending on the market, investors may place greater weight on financial performance, governance and ownership, international credibility, or the broader economic context surrounding a listing.

Preparation is another recurring theme. The report recommends starting communications work before the public phase, identifying risks and difficult questions in advance, and putting monitoring and response arrangements in place before they are needed.

Finally, the report is explicit about the limits of communications. A clear investment story can help investors understand a company and its proposition, but communications cannot replace strong business fundamentals or the execution of the strategy presented at listing. NorthStar Insights therefore describes an IPO as the beginning of a longer relationship with public markets rather than the end of the communications process.

Hawthorn Advisors, an independent strategic communications firm with offices in London, New York and Abu Dhabi, has welcomed Amer Aïdi as Partner. In this role, he leads business growth for the Abu Dhabi office, advising government, sovereign and private sector clients on strategic communications, reputation and stakeholder engagement, while serving the firm's existing client base, working alongside Partner Tracey McLaine.

Amer brings more than 25 years of communications experience, including reputation and crisis management and public affairs, and has worked with government institutions and agencies. He has worked at Hub71, Abu Dhabi Health Services Company (SEHA), Waha Capital, Omnicom Media Group, Abu Dhabi Finance and Weber Shandwick. Most recently, Amer was Communications Advisor to the Director General at ADIO.

”To have Amer join us at Hawthorn is terrific and he will be another valuable Partner in the Abu Dhabi office and the firm more broadly,” said John Evans, CEO, Hawthorn Advisors. “Amer brings a wealth of experience from consultancy, as well as in-house positions in the private and public sectors, most recently at ADIO where he was a Communications Advisor to the Director General. Our team in Abu Dhabi is going from strength to strength, and I am excited for what can be achieved."