PR News
<span id="hs_cos_wrapper_name" class="hs_cos_wrapper hs_cos_wrapper_meta_field hs_cos_wrapper_type_text" style="" data-hs-cos-general-type="meta_field" data-hs-cos-type="text" >Research Wrap: Senate SHJ Crisis Index 300</span>

Research Wrap: Senate SHJ Crisis Index 300

Senate has released its 2025 Crisis Index 300 research, revealing the financial impact of some 300 crises impacting listed firms across 32 industry sectors over the past 40 years. The study revealed the average resulting drop in share prices was 35.2 per cent, and the companies involved took an average of 427 days to recover from a crisis, while nearly a third of the companies' share prices have yet to recover. Telum spoke with Craig Badings, Partner and Head of Reputation at SenateSHJ, to understand some of the detail behind the research, and the lessons listed companies and other firms can take from the study.

Are the scenarios and the crises that are detailed in the index across the different industries worst case scenarios, or are there lessons in here for a typical listed entity?
There are always lessons for listed entities or any company for that matter. It often depends on what the crisis is and how they react to that crisis.

We've seen in the past, companies that deal with crises will typically recover quicker. And there are some great examples where companies have done it well. Johnson and Johnson. Whole Foods. KFC.

But those who deal with it badly can create a secondary crisis for themselves based on the way they react or don't react.

The Index is based on crises befalling listed companies globally, but they can impact any firm. Is the impact on listed firms exacerbated because of the attention they get from analysts and investors?
It depends what that focus from the shareholders or the investors is like. If the shareholders or investors view the company as handling the crisis well - they're doing everything they can to rectify it, they've been transparent, they have apologized, they have laid out what they're going to do to make the reforms required – then typically that results in less of the blowtorch being applied by those stakeholders.

However, analysts and shareholders in particular, if they view the company as being remiss in their response, not transparent, hiding behind too much legalese, or slow to react and not being authentic, the punishment can be quite harsh.

A lot of these crises were either “self-inflicted” or at least preventable. Are there any common lessons we can learn from these?
Typically, when we look back at a crisis, including many of those that are listed on the Crisis Index, it's often a result of culture, or behaviour, and typically that behaviour occurs across seven categories:
  • Taking a shareholder primacy over the stakeholder primacy view
  • Not taking a stand on an issue
  • A lack of governance
  • Gaps in supervision, monitoring or reporting
  • Taking shortcuts
  • Blame culture - them versus us, like a union stoush
  • Training and staff, such as security guards put at the doors of hotels during the pandemic with no training in how to deal with COVID
The report talks about the importance of preparedness and scenario planning and testing, but some things are unforeseeable, and can't be prevented, like natural disasters or pandemics. How far should a company go in anticipating and planning for events that are out of their control?
Planning is everything. Everything.

If you don't plan and run crisis simulations, I can guarantee your response is going to fall over, or your team is not going to be up to it.

Those simulations very often need to take into account things that are outside your control, but also things that typically could happen in your environment.

But if you're not going to be running simulations, and you're not going to test your people and your processes, I guarantee you're going to have a problem.

I can't begin to tell you how many companies don't run simulations. And they find out when the proverbial hits the fan that they're just not prepared.

I think it was a Prussian Field Marshal who said no battle plan survives its first encounter with the enemy. How much of a difference can preparation make - what advantages does it give you when the proverbial does hit the fan?
There are three advantages. The first is teamwork. If you run a simulation, the team starts knowing who's doing what, and you can start relying on people and trusting people. And you can only do that when you're under the pump.

The second advantage is when you're under the pump, you discover where the gaps are. Running a simulation will highlight the gaps both in your crisis response, and also your operational response internally.

And that leads to the third thing: typically in a crisis, the management within the crisis management team doesn't have time to run the business.

And so when you run a simulation, they quickly realize they may be taken out for a week, a day, two weeks, or more. Who runs the business when they're running the crisis?
 
You’ve opened up the information behind the Crisis Index providing free access to firms to analyse and draw information from. How can they use it?
There are a lot of ways. If you're an analyst in the banking and financial services and insurance sector, you can have a look at it to understand what the biggest threat is in that sector.  What are they most likely to suffer in terms of a crisis? We know from the Crisis index 300 that it's actually mismanagement and white collar crime.

So an analyst could say to the bank that they invested in, what are your plans for managing a crisis that involves mismanagement of white collar crime?

Another example would be a crisis manager handling an issue at an automobile manufacturer, and they can go into the Crisis Index and find out what typically is the length of time to recovery for EPS or share price in that sector. They can look at what they need to do to mitigate that and bring that back a bit. At what they need to put in place that can help this company or brand recover quicker.

Finally, Criag, aside from “be prepared” are there sort of fundamental principles underpinning effective crisis response?  
We know from decades of dealing with crises that ultimately, your guiding light, or your North Star, should be your values or vision statement - that should guide your decisions.

Too often we see decisions made in the heat of the moment that are ego-driven, or outrage-driven, and by that I mean companies are outraged at the regulator or they're outraged at the consumer, the way they're getting stuck into the company. That never leads to a good decision.

Always stick to your values when you're making a decision. And don't let fear or confusion interfere with that moral compass or cloud your decision making.

And finally, an apology doesn't make you legally liable. If you apologize, you can do it in a way that doesn't admit fault, but actually does show genuine concern for those who are impacted.

I can't tell you how many times lawyers get in the way of apologizing, and the company comes across as cold-hearted, uncaring, and their stakeholders turn around and say, you guys actually don't give a damn.

Empathy is absolutely key to the way you respond and it's always got to be a people-led response, a human-led response, because otherwise you run the risk of being called callous and uncaring.
Previous story

Perspectives: Doing the write thing with AI

Next story

Study Highlight: The 2025 Edelman Trust Barometer for Australia

You might also enjoy

Umesh
Moves

Umesh Ratnagobal joins construction company as Head of Corporate Affairs

Umesh Ratnagobal has joined Australian construction company, Kapitol, as Head of Corporate Affairs. He was previously at Laing O'Rourke as Head of Government and Client Relations. Prior to this, Umesh held comms roles within the government, tech, and oil and gas sectors.

Sefiani: Cyber
Research

Sefiani: Cyber incident playbook needs a rewrite for the AI era

Historical data breaches are resurfacing in AI-generated answers when consumers evaluate whether to trust or purchase from an organisation, potentially extending their reputational impact long after the incidents have been resolved, according to a new report by Sefiani, part of Clarity Global.

The research, Cyber Breaches and Reputation Response in the AI Era, combined a nationally representative YouGov survey of 1,019 Australian adults, conducted between 19 and 24 August 2026, with an analysis of how three AI search tools reference historical cyber incidents across different stages of the customer journey.

Using its Surfacd AI visibility tool, Sefiani examined three organisations that had experienced significant data breaches: a global law firm, a global logistics company, and an Australian private health insurer. The analysis tested 30 prompts per organisation across ChatGPT, Google AI Mode, and Google AI Overviews.

The findings suggest that while consumers may be willing to remain with organisations following a data breach, the way a company communicates its response and subsequent improvements can have lasting reputational implications.

Breach visibility increases closer to purchase decisions

The study found that historical data breaches were rarely mentioned in AI-generated responses during the initial stages of customer research but became increasingly visible as queries shifted towards evaluating specific organisations.

During the category discovery stage, past breaches appeared in an average of 2.7 per cent of AI responses across the three organisations. This increased to 13.1 per cent during brand validation and 42.2 per cent at the decision stage, when users asked more directly about an organisation's trustworthiness.

For one organisation, breach history appeared in 59.1 per cent of decision-stage responses.

The research also found that AI responses did not exclusively frame historical breaches negatively. Some answers referenced how organisations restored services, improved security, or responded to incidents.

According to Sefiani, this means organisations need to consider how their handling of an incident continues to be represented publicly, even after the immediate crisis has been resolved.

Customer loyalty depends on the response

The YouGov survey found that 31 per cent of Australian respondents said they would stop using an organisation following a data breach, while 53 per cent said they might stop.

However, the research identified a gap between stated intentions and reported behaviour, suggesting that experiencing a data breach does not necessarily result in customers abandoning an organisation.

Among all respondents, 57 per cent had been customers of an organisation that experienced a breach. The report found that 13 per cent had moved to another provider, while 24 per cent considered leaving but stayed, and 20 per cent did not consider leaving.

When asked what would influence their decision to continue using a company following a breach, respondents identified measures taken to prevent another incident as the most important factor (39 per cent). This was followed by the seriousness of the breach (32 per cent), the type of customer information affected (32 per cent), transparent communications about what happened (30 per cent), and support offered to affected customers (29 per cent).

The study also tested how descriptions of an organisation's breach response in AI-generated answers could influence purchasing intentions.

When respondents were presented with a scenario in which AI reported that an organisation had been slow to notify customers and lacked transparency, 28 per cent said they would purchase from it. This increased to 57 per cent when the AI response described prompt customer notification, clear explanations, and practical support.

By comparison, 67 per cent said they would purchase from an organisation that was generally well reviewed, with no data breaches mentioned.

 

Where AI draws its information from

Sefiani also examined the information sources referenced by AI when generating answers about the three organisations.

Corporate content, including company websites and owned reports, appeared most frequently, referenced in 88 per cent of responses. Editorial media coverage followed at 61 per cent, while government and regulatory sources appeared in 55 per cent, and user-generated content, including social media, in 36 per cent.

The report noted that the source mix varied depending on the sector and the nature of the query.

These findings highlight the role of both owned communications and independent third-party information in shaping how AI presents an organisation's reputation.

According to Sefiani, organisations that stop communicating publicly once a breach has been resolved risk leaving AI tools to draw on historical media reports and other third-party commentary without access to an updated account of the company's response.

Sefiani's Managing Partner, Mandy Galmes, said organisations should consider what information remains publicly available after the immediate incident has passed.

"Once the incident is resolved, organisations need to publish a clear, factual account of what happened, what they did and, importantly, what they have changed, on their own channels. This means AI has your own version of the incident. If this step is missed, AI will build the story and define your reputation for you, from whatever media coverage or third party commentary appeared."

Updating the crisis communications playbook

The report argued that established cyber crisis communications practices, including timely disclosure, factual updates, and customer support, remain important but need to account for how AI tools retrieve information long after an incident.

It proposed five additional considerations for organisations managing cyber incidents:

  • Publish a factual account of the incident and response: Maintain an accessible summary on owned channels outlining what happened, how customers were supported and what has changed to reduce the risk of recurrence.

  • Engage with credible editorial media: Consider providing journalists with a factual account of the organisation's response, remediation and lessons learned to create an independent record.

  • Maintain customer support beyond the immediate incident: Recognise that customer experiences may continue to influence reviews, social media discussions and other content used by AI.

  • Share lessons with industry stakeholders: Work with industry bodies and peers to communicate relevant learnings that could support broader cyber preparedness.

  • Monitor AI-generated responses over time: Assess how AI platforms describe the organisation before and after an incident, including which sources and narratives they reference.

Co-founder and CEO of NSB Cyber, Shane Bell, highlighted the importance of communications during the initial response.

"Good and bad cyber incidents used to come down purely to technical judgement. A bad incident is now more often than not one that was poorly communicated. Technology discussions tend to dominate the first 72 hours, when communications should be front and centre. Organisations that struggle are the ones least prepared to talk to the regulators, suppliers, partners and customers," he said.

What communications professionals need to know

The research suggests that the reputational consequences of cyber incidents may extend beyond the traditional news cycle, particularly as AI tools increasingly draw on historical information when responding to questions about organisational trustworthiness.

For PR and communications professionals, the findings point to the importance of maintaining an accurate, accessible record of an organisation's response and remediation, alongside continued engagement with customers and relevant stakeholders.

For media professionals, the study highlights the potential longer-term role of editorial coverage as a source of information in AI-generated assessments of organisations.

The findings also suggest that post-crisis communications should not be measured solely by the immediate public response. Monitoring how past incidents and subsequent corrective actions are represented across AI platforms may become another consideration in long-term reputation management.

Amy
Moves

Amy Wilson recommences in the mining sector

Amy Wilson has begun a new role as Principal Communications and Corporate Affairs at Stanmore Resources. She has wrapped up a stint in the water sector at Urban Utilities as Senior Engagement Specialist. Prior to this, Amy held comms roles at mining company, Bravus Australia (formerly Adani Australia) for nearly eight years.