On 13 April 2024, Westfield Bondi Junction in Sydney became the scene of a tragic attack that would claim six innocent lives and leave twelve more people injured. While police were still clearing the building and paramedics were treating the wounded, the shopping centre's social media accounts continued posting promotional content that was already scheduled.
The posts continued running, with cheerful branded content landing alongside breaking news footage of shoppers being carried to ambulances. This could have been avoided had the communications team been included in crisis call-out procedures, with pre-assigned authority to pause scheduled content when the unthinkable happened.
This situation highlighted a gap that exists in the crisis management plans of many large organisations, where communications are treated as a support function that activates after an operational response is underway rather than as a discipline that must activate simultaneously, within the same first minutes, using pre-built systems and pre-authorised people who know exactly what to do before anyone picks up a phone.
Organisations that handle crisis communications well share a common trait. They have recognised that the speed and ferocity of the modern information environment has narrowed the window for response from hours to minutes, and they have built their communications infrastructure accordingly.
This article draws on Kenyon's experience across more than 700 incidents to set out what robust crisis communications infrastructure looks like, why it matters, and where many organisations still fall short.
Building a Crisis Communications Architecture
Effective crisis communications cannot be improvised, and the organisations that perform best under pressure are those that have invested in architecture before the crisis arrives. Systems, roles, templates, and channels that activate as part of the overall crisis response rather than trailing behind it.
The Crisis Communications Director
Every crisis management plan should designate a Crisis Communications Director whose authority and responsibilities are defined in advance and whose role activates the moment the crisis management team is called. This individual does not need to be the most senior person in the communications function, but they must have direct access to the crisis management team lead, the authority to approve messaging without waiting for multi-layered sign-off, and a clear understanding of what can and cannot be said in the early hours of a response.
The Crisis Communications Director coordinates messaging across every channel, ensures consistency between what is being said to affected families, to the media, to employees, and to regulators, and serves as the single point of accountability for the communications workstream throughout the response.
Trained Spokespeople at Multiple Levels
A single corporate spokesperson, however capable, cannot sustain the communications demands of a major incident across multiple time zones, languages, and audiences. Effective plans designate multiple spokespeople with clearly defined roles: local spokespeople at the incident site who can speak with authority about the immediate response, and a senior executive, often the CEO, who can speak to the broader organisational response and demonstrate visible, personal leadership.
Every designated spokesperson should have completed media training that includes realistic crisis simulation, because the skills required to deliver a confident quarterly earnings presentation bear almost no resemblance to the skills required to face a room full of journalists when an organisation is at the centre of a major incident. Video statements from leadership are now expected by the public and the media within hours of a significant event, and an executive who has never practised delivering that kind of statement under genuine pressure is far more likely to compound the situation than manage it effectively.
Our Crisis Communications: Spokesperson Training course is designed specifically for this. It uses realistic simulation to prepare individuals for the most demanding media environments, so that when the moment arrives, those speaking for the organisation have already been through the process and have a strong foundation to draw upon for communicating after a crisis.
Dark Websites and Pre-Built Digital Infrastructure
A dark website is a fully designed, pre-populated crisis information page that sits dormant on a separate server, ready to be activated within minutes of an incident. It typically includes the organisation's initial holding statement, contact information for affected families, links to verified updates, and functionality for families to register their details and receive private communications.
Dark websites have become standard practice among well-prepared organisations for a simple reason: they work. They provide a single, authoritative source of information that can be referenced by media, shared on social media, and updated in real time as the situation develops. They also separate crisis information from the organisation's normal commercial web presence, which avoids the jarring effect of promotional content sitting alongside emergency updates.
The digital infrastructure extends beyond websites. Pre-drafted social media templates, pre-approved holding statements, and pre-established private communication channels for affected families should all exist in ready-to-activate form. The minutes spent creating these assets from scratch during a live crisis are minutes during which the narrative is being shaped by everyone except the organisation at the centre of it.
Our Crisis Communications: Planning and Preparedness and Digital and Social Media modules address dark website architecture and digital readiness in detail.
The First Statement: Three Elements That Cannot Wait
The initial communication from an organisation following a major incident carries disproportionate weight, both because it sets the tone for everything that follows and because it is the moment when public judgment begins to form about whether the organisation is competent, compassionate, and in control.
Kenyon's experience across more than 700 incidents has consistently demonstrated that effective initial statements contain three elements, delivered together and without equivocation:
1. The first is an acknowledgement that the incident has occurred, stated plainly and without hedging language that suggests the organisation is uncertain whether something has actually happened.
2. The second is confirmation that a response plan has been activated and that specific actions are already underway, because the public needs evidence that someone is doing something, not merely that someone is aware that something has happened.
3. The third is a genuine expression of concern for the people affected, delivered in language that sounds human rather than legal, because families, employees, and the public can recognise the difference between an empathetic statement and one that is primarily concerned with the organisation’s own protection.
These three elements can be delivered in four or five sentences. They do not require confirmed facts about causation, numbers of those affected, or operational details that are not yet known. They require honesty about what is happening, evidence that the organisation is responding, and empathy to acknowledge that people are going through something very difficult.
Families First, Always
The principle is simple: the families of those affected should receive information before the media does, before employees do, and before the general public does. Every communication sequence should begin with affected families and work outward from there.
This is not merely an ethical position, though it is certainly that. It is a practical one. Families who learn about the loss or injury of someone they love through a television broadcast or a social media post experience a compounding of the already profound pain they are carrying, and that experience fundamentally changes their relationship with the organisation responsible. The legal, financial, and reputational consequences of failing to honour the families-first principle have been demonstrated so consistently across so many incidents that no responsible crisis management plan can afford to ignore it.
Private family communication channels, whether through a dedicated call centre, a secure section of the dark website, or direct liaison through trained family assistance coordinators, must be established and operational before any public-facing communication is released. Kenyon builds this sequencing into the crisis communications plan from the outset, so that the families-first principle is embedded in process rather than dependent on someone remembering to follow it in the middle of an already overwhelming response.
Our Survivors, Families, and Friends training module addresses the practical and human dimensions of family communication in detail.
A New Threat: AI-Generated Misinformation
The communications environment of the 2020s has introduced a dimension that did not exist when Kenyon first codified its approach to crisis communications, and it is one that materially changes the challenge for every crisis communications professional. Artificial intelligence can now generate convincing fabricated images, fake official statements, and synthetic video content within minutes of a breaking incident, using tools that are widely available to anyone with a smartphone.
During any major incident in 2026, a crisis communications team must contend with the possibility that fabricated imagery will circulate on social media alongside genuine footage, that fake statements attributed to the organisation could be shared and amplified, and that synthetic audio or video could potentially be used to undermine the organisation's credibility at the worst possible moment.
The response to this threat is not primarily technological, though monitoring tools and verification processes are important. The response is speed and authority. An organisation that establishes itself as the primary, credible, and consistently updated source of information from the outset of an incident leaves less space for fabricated content to fill.
A dark website activated within minutes, a verified social media presence issuing regular updates, and a visible senior leader speaking directly to the public through video all contribute to an information environment where an authentic narrative dominates.
The Integration Imperative
Crisis communications cannot function in isolation from the broader crisis management and response operation, and any plan that treats communications as a support layer rather than an integral part runs the risk of producing a disjointed and reactive response.
The communications team must be in the room when operational decisions are being made, because every operational decision has a communications dimension, and learning about those decisions after they have been taken and announced leaves the communications function perpetually behind a public that is already asking questions about what it has just seen.
Kenyon International builds communications integration into the core of its crisis management and response framework, ensuring that every element of the operation feeds into and is informed by the communications strategy. For organisations seeking to assess and strengthen their own crisis communications readiness, the question is whether the architecture described in this article exists within their plans today, whether it has been tested under realistic conditions within the past twelve months, and whether the people assigned to activate it could do so at three o'clock in the morning with no advance notice.
Ensuring this infrastructure is in place before a crisis arrives is the most valuable investment an organisation can make.
For a comprehensive foundation in crisis management across all disciplines including communications, our 12 Principles of Crisis Management course draws on more than 120 years of operational experience to help organisations build the capability to respond rapidly, coherently, and with genuine care for the people at the centre of every incident.
If you’re interested in discussing how we can support your organisation’s crisis management and response efforts, please get in touch.
Frequently Asked Questions
How quickly should an organisation issue its first statement after a major incident?
The expectation has shifted significantly over the past decade. The current environment demands a first communication within fifteen to thirty minutes of the incident becoming publicly known. This initial statement does not need to contain detailed facts, which will not yet be available, but it must acknowledge the incident, confirm that a response is underway, and express genuine concern for those affected. Organisations that have pre-approved holding statements and activated dark websites can consistently meet this timeline. Those that begin drafting from scratch under pressure will almost certainly miss it.
What is a dark website and why is it considered standard practice?
A dark website is a pre-built crisis information page hosted separately from the organisation's main website, designed to be activated within minutes of an incident. It provides a single authoritative source of verified information for families, media, and the public, and it prevents promotional content from appearing alongside emergency updates. Dark websites typically include holding statements, family registration portals, contact information, and real-time update sections. They are now considered standard practice among well-prepared organisations in aviation, energy, maritime, and other high-consequence sectors.
Why must families receive information before the media?
Families who learn about the loss or injury of a loved one through media coverage experience a compounding of already profound pain, and that experience permanently changes their relationship with the responsible organisation. Beyond the profound ethical obligation, there is a practical dimension: families who feel they have been treated with honesty and respect are far less likely to become adversarial. Embedding this principle into communications sequencing, rather than relying on individuals to implement under pressure, is essential.
How should organisations prepare for AI-generated misinformation during a crisis?
The primary defence against AI-generated misinformation is establishing and maintaining information authority from the earliest possible moment. Organisations should activate verified communication channels immediately, issue regular updates through their dark website and official social media accounts, and ensure their designated senior spokesperson is visible and accessible. Spokespeople should be trained in how to address misinformation directly without amplifying it.
What are the key roles in a crisis communications team?
An effective crisis communications team requires, at minimum, a Crisis Communications Director with authority to approve messaging and direct access to the crisis management team lead, multiple trained spokespeople including at least one senior executive, a social media coordinator with pre-authorised access and the ability to pause scheduled content immediately, a media monitoring lead, and a family communications liaison who ensures families are briefed before any public-facing statements are released. Each role should have a designated deputy, and every individual should have exercised their role under realistic conditions at least once in the preceding year.
How does Kenyon support organisations with crisis communications?
Kenyon International is TrustFlight's crisis management and response capability, with more than 120 years of experience across 700 incidents. Kenyon's crisis communications support includes pre-incident planning and architecture development, spokesperson training under realistic crisis simulation conditions, crisis communications exercises that test the full communications chain from initial activation through sustained multi-day response, and 24/7 support during live incidents. Kenyon's five-category measurement framework enables organisations to benchmark their crisis communications readiness and identify specific gaps before they are exposed under operational pressure.