Cyber Risk: What Communicators Need to Know in 2026

The CIPR Crisis Communications Network kicked off its 2026 events calendar with an energetic discussion on one of the most pressing issues facing organisations today: cyber risk. With more than 190 people in attendance – a record for us! – the event brought together experts from across the cyber risk landscape to consider how cyber threats are changing and explore what “good” looks like when communicators are faced with a data breach, major incident or worse.

Chaired by the Network’s Chris Tucker and Felix Östman, the panel featured Rachel Andvig from Willis Towers Watson, Jim Steven from Experian, and Alex Wheeler from the UK’s Information Commissioner’s Office (ICO). Together, they provided a first-hand and practical view of cyber preparedness, response, and recovery – with clear takeaways for communicators.

A rapidly changing risk landscape

Rachel Andvig set the scene by outlining what’s happening in the cyber world today – and why no organisation can afford to be complacent. Attacks are not only more frequent, but more complex and commercially motivated. The UK alone sees multiple significant cyber incidents every week, ranging from multi‑layered ransomware attacks to social engineering and supply chain compromise.

We’re now seeing double or even triple extortion attacks.

“We’re now seeing double or even triple extortion attacks,” Rachel explained. “Systems are being locked, data is stolen, and ransoms are demanded to keep it from being distributed.”

She also highlighted the growing role of artificial intelligence – not just in defence but increasingly in offence. Threat actors are harnessing AI to increase the speed, precision and scale of attacks. “It’s no longer if you’ll face a cyber incident, but when,” she said.

For communicators, that means understanding the nature of these threats and the likely impacts – from operational disruption to reputational damage. Rachel urged PR professionals to ensure they’re included in cross‑functional crisis teams and to know what resources are available through their company’s insurance, which often includes access to specialist PR and incident response consultants.

Communicating under pressure

When an attack strikes, clear, timely and accurate communication is critical. Experian’s Jim Steven spoke about his team’s work helping organisations contact thousands – and sometimes millions – of affected customers following a data breach.

For many, managing this process can be logistically and emotionally challenging. Scripts must be agreed by legal advisers, translated into multiple languages or dialects, approved by regulators, and aligned across brands and territories. Meanwhile, customers and employees are anxious, sometimes desperate, for information.

Go out too fast and risk sharing incomplete information; wait too long and lose control of the narrative.

“Do you tell quickly – or correctly once?” Jim asked – describing this as the constant dilemma organisations face. Go out too fast and risk sharing incomplete information; wait too long and lose control of the narrative. He advised companies to plan, practise, and prepare, including creating draft microsites, pre-agreed scripts and even call‑centre crisis plans which are ready to go.

Jim also reinforced the importance of scenario testing: “Because the attackers are trying to get ahead of your story, the practice piece – at pace – is what matters.”

What the regulator expects

Representing the ICO, Alex Wheeler provided guidance on what the Commissioner’s office looks for when assessing cyber breach notifications. Under GDPR rules, organisations must report certain breaches within 72 hours if there is a risk to individuals’ rights and freedoms. Transparency and completeness are key, but regulators understand that initial information will be limited.

“The more open and high‑quality the report [you give us], the more we can help you,” Alex said. He also underscored the need to notify affected individuals where the risk is high – particularly when the loss of sensitive or financial data is involved.

From a communications standpoint, he urged organisations to be honest, clear, and offer reassurance: “Even if you don’t have all the answers, demonstrate that remedial action is being taken. People value transparency.”

Alex reminded participants that the ICO is not looking for individual blame: “It’s not a manhunt” he said. “Communicators play a valuable role in reassuring employees and avoiding a culture of fear.”

The human factor: internal comms and culture

A recurring theme was human vulnerability. Many cyber incidents begin with a simple click on a malicious link. Both Rachel and Alex stressed the importance of internal communications in building organisational awareness of the risks, and improved resilience.

Internal comms teams should lead ongoing education campaigns – not just once a year, but regularly enough to keep awareness alive without creating fatigue. Practical phishing tests, updates on emerging cyber scams, and clear guidance on how to report suspicious activity all help strengthen that all important first line of defence.

“cyber hygiene” can be especially effective: “When employees understand how to protect themselves personally online, they become better defenders professionally.”

Jim noted that town‑hall briefings on “cyber hygiene” can be especially effective: “When employees understand how to protect themselves personally online, they become better defenders professionally.”

Testing, teamwork, and tension

The panel emphasised that cyber incidents are inherently cross‑functional events, involving IT, legal, compliance, security, HR, and comms. Tensions between teams are inevitable – especially between PR (wanting to communicate fast) and legal advisers (advising caution).

Ultimately, as Jim noted, these decisions must be made collectively, with board‑level sponsorship: “You can’t eliminate all risk, but you can make informed and honest decisions.”

When it comes to training, panellists agreed that simulations – not just tabletop discussions – are most effective. Real‑time exercises that include multiple system failures, information gaps, and time pressure help teams understand what a real-life cyber crisis feels like.

Preparing for what’s next

So, have we reached “peak cyber”? All three experts agreed: absolutely not. AI‑driven attacks, deepfakes, and even the emerging risks of quantum computing all suggest the threat environment will keep evolving.

The key takeaway: organisations must stay flexible. Fix today’s weaknesses but plan for tomorrow’s. Build trusted relationships across your departments, keep communication lines open, and prepare now – while the sun is still shining. Cyber incidents will continue to challenge organisations, but they also present an opportunity for communicators to lead – with calm, clarity and credibility – when it really matters.

Author: Jo Barrett, CIPR Crisis Communications Network Committee
Image: AI Generated