Out-of-Band Communications During a Crisis: 4 Things That Work, and 4 That Don’t
At 6:40 on a Monday morning, the CFO gets a text from the general counsel: Don’t reply to anything on email or chat. Call me. By 7:15, a dozen senior leaders are trying to join a call. Half of them got the dial-in by forwarded email. Two can’t log in because their passwords stopped working overnight. Someone starts a group text from a personal phone, and within an hour there are three threads, two sets of instructions, and nobody sure who’s on which.
None of those people did anything wrong. They just had nowhere safe to go.
And while this scenario is illustrative, the underlying problem is very real. When NotPetya struck shipping giant Maersk in 2017, it knocked out approximately 150 domain controllers, crippling the identity infrastructure that governed access to its global systems. Corporate email went down, and employees resorted to personal Gmail accounts, WhatsApp, and spreadsheets to keep business moving. One customer even reported booking 500 shipping containers through WhatsApp, according to WIRED’s investigation of the NotPetya attack.
Maersk found a way to keep communicating, but only by improvising outside its corporate systems. The incident illustrates a critical vulnerability: when a corporate crisis hits, the very systems organizations depend on to communicate, authenticate users, and coordinate their response may be the first to fail. Email may be down or, worse, still operating but accessible to an attacker. And when identity infrastructure fails, the backup tools that depend on it can fail right alongside everything else.
The trigger varies: a destructive cyberattack, a major identity or cloud outage, or an insider threat that makes internal channels suspect. The result is the same. Leaders who need to make fast, high-stakes decisions can’t rely on the tools they use every day. As organizations become more dependent on interconnected systems, a disruption to communications or identity can quickly become a disruption to the entire response.
Out-of-band communications exist for exactly this moment: a trusted, independent way to communicate when corporate systems are unavailable or cannot be trusted. But restoring communications is only the first step. Leaders still need to make decisions, assign responsibilities, coordinate actions, and maintain a defensible record. That’s the difference between communication continuity and response continuity.
Why everyday channels fail when you need them most
Most companies run on a tightly integrated stack: common identity infrastructure, email, chat, and document repositories. That integration is efficient on a normal day. In a crisis, it creates shared points of dependency.
If corporate identity systems become unavailable or compromised, employees may lose access to the very tools they need to coordinate a response. If an adversary or insider has access, sensitive discussions may be exposed. And even when systems are technically operational, uncertainty about whether they can be trusted can delay critical decisions.
The problem isn’t SSO itself. It’s relying on the same systems for both everyday operations and crisis response without a tested alternative. Organizations that plan ahead establish independent communication capabilities and fallback authentication options so the response can continue even when primary systems cannot be trusted.
4 things that work
The out-of-band setups that hold up under pressure share four traits.
- Independent of the systems at risk. It relies on infrastructure and access methods that remain available when the corporate directory, email system, or single sign-on is compromised or unavailable. Its security should not depend on trusting the very systems under investigation.
- Provisioned, with controlled access. Accounts, rosters, and permissions are set up in advance for the stakeholders who need them. Access is verified and controlled, without requiring teams to improvise invitations and permissions in the middle of a crisis.
- Familiar before it’s needed. Executives, legal, communications, IT, and operations leaders have logged in and practiced. A crisis is the wrong time to learn a new tool.
- Connected to the response, not just the conversation. Teams need incident context, current procedures, assigned responsibilities, decisions, and supporting documentation. Communications should connect to an authoritative incident record rather than being reconstructed afterward from disconnected messages and meeting notes.
4 things that don’t
Each failure below is the mirror image of a trait above, and each looks reasonable right up until it’s tested.
- Ad hoc conference bridges. A dial-in shared over the email system you’re worried about isn’t out of band. Neither is a meeting link created through an identity provider that may be compromised.
- Mass notification as the backup. Broadcasting alerts to thousands of employees is a different job from a small group of senior leaders making sensitive decisions together. Both matter, but one can’t stand in for the other.
- The plan on the shelf. Backup channels listed in a document but never exercised fail on details: outdated numbers, expired accounts, people who don’t know where to go.
- Personal messaging apps. They’re familiar, convenient, and often offer end-to-end encryption, as with Signal, making them an appealing fallback during a crisis. But encryption alone doesn’t make a channel suitable for enterprise response. These apps can scatter decisions across personal devices, lack centralized access management, enterprise retention and audit controls, and complicate legal discovery when sensitive incident discussions need to be preserved or reconstructed.
Why the difference matters
The pattern behind both lists is trust. In a crisis, people need confidence that their communications are secure, the right people have access, and decisions reflect the latest authoritative direction. Improvised channels can undermine that confidence. Prepared, independent communications provide a more reliable foundation for the response.
Trust also extends to sensitive discussions. Legal counsel may need to collaborate with security and executive leadership while protecting potentially privileged communications. That requires more than encryption. Role-based access and protected workstreams help maintain appropriate boundaries, while consistent documentation supports accountability without assuming that the technology itself establishes legal privilege.
But trusted communications are only the starting point. The real value comes from what teams can accomplish once they’re connected. They need to make decisions, assign work, and maintain a defensible record as the response unfolds. That’s the difference between a backup communication tool and an environment built to manage the response. Standalone messaging platforms reconnect people. Cybersecurity Incident Response Management (CIRM) connects those conversations to the broader response workflow, helping the enterprise coordinate action, address regulatory obligations, and document decisions from beginning to end.
Make it ready before it’s needed
Out-of-band communications aren’t an emergency kit for a once-a-decade event. They’re a foundational part of cyber resilience, and they only work when they’re provisioned, exercised, and familiar before a disruption. Realistic tabletop exercises help teams test access, responsibilities, communications, and decisions before those capabilities are needed in a live crisis.
BreachRx takes out-of-band communications beyond backup messaging. Built into the Rex Platform™, Out-of-Band Comms brings Mail, Chat, Meetings, Scratch Pad, and Mobile Command™ together with the response workflows, role-based responsibilities, protected workstreams, and authoritative incident record that drive coordinated action. Security, IT, legal, communications, and executive teams can keep the response moving when corporate systems can’t be trusted. Don’t just move the conversation. Move the entire response.
Read the Gartner® Buyer’s Guide to Out-of-Band Communication Platforms for Cybersecurity Incidents
