By Ann Marie van den Hurk, Mind The Gap Advisory
When people search for AI crisis management, they are usually looking for software. Detection platforms. Signal aggregators. Automated monitoring tools that promise to catch a problem before it spreads. What most of them need is something no platform sells: a named person with the authority to decide before the facts are confirmed.
That gap isn’t a marketing problem. It’s the reason well-equipped organizations still found themselves behind the incident during the last cycle of deepfakes, ransomware, and AI-driven misinformation.
What the search results actually sell
Type “AI crisis management” into a search bar and the results sort into three categories. Detection and monitoring tools that flag anomalies across systems and networks. Consulting firms offering compliance audits and readiness assessments. Software vendors selling automated response workflows.
All of it answers the same question: what happened, and how fast can we see it.
None of it answers the question that actually determines the outcome: who gets to decide.
They’ve invested in monitoring. They have a vendor relationship for detection. Someone on the security team gets an alert within minutes of an anomaly. Then nothing happens for twenty, thirty, sometimes sixty minutes, because the alert has nowhere to go.
No one was named in advance as the person who can declare this a crisis, authorize the first external statement, or halt a process without waiting for a meeting that hasn’t been scheduled yet.
Detection speed and decision speed run on two different clocks
This is the first 20 minutes problem, and it has nothing to do with technology maturity. An organization with a sophisticated AI detection stack and an organization running manual log review can fail in exactly the same way, because the failure happens after detection, not during it.
Consider a deepfake of a CEO circulating on LinkedIn at six in the morning. The monitoring tool did its job. It flagged the anomaly within minutes. But someone still has to decide, in real time, whether this rises to a public statement, who drafts it, and who can release it before legal has reviewed every word. If those roles were never assigned in advance, the tool’s speed doesn’t matter. The organization is still waiting on a decision that has no clear owner.
AI crisis management, as a search term, assumes the problem is visibility. Buy the right tool and you’ll see the crisis coming. Visibility was never the constraint for most of the organizations I’ve worked with. They see the signal. What they lack is a pre-built structure for what happens the moment after someone sees it.
A tool stack doesn’t prove the governance worked
The same pattern shows up in ransomware. A threat intelligence platform flags lateral movement across three systems. The alert is accurate and it arrives fast. What determines whether the next twenty minutes go well is not the alert. It’s whether someone already has standing authority to escalate, engage outside counsel, or take systems offline without convening a committee first.
This is also why “AI crisis management consulting” so often disappoints the organizations that search for it. Many engagements in this space are built around the same assumption as the tools. They audit detection capability, benchmark the monitoring stack against peers, and hand over a compliance checklist. That work has value. It doesn’t answer who decides, because that’s a governance question, not a technology or compliance question, and it has to be answered before an incident, not documented after one.
Detection and monitoring are necessary. They are not sufficient. The operational core of crisis readiness is decision authority, defined and assigned before the first 20 minutes of a real incident begin, so that when a signal arrives, someone is already positioned to act on it.
The test worth running
If your organization is evaluating AI crisis management tools or consultants right now, the useful question isn’t which platform catches the most signals. It’s whether your leadership team could answer, in under five minutes and without opening the incident response plan, who has the authority to declare a crisis, authorize the first statement, and halt a process if needed.
If your leadership team can’t answer that today, no tool will close the gap once an incident starts.
If you want to know whether your team can answer that
Crisis Decision Authority Diagnostic
A 90 minute session that produces a First Hour Gap Summary within three business days, showing exactly where decision authority is undefined before an incident makes that visible in public.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations across New England, nationally, and globally. mindthegapcyber.com