Artificial Intelligence in Crisis Management: The Threat, the Tool, and the Test

Artificial intelligence shows up in your crisis program in two ways. It causes crises, and it helps the people responding to them. Most writing on AI in crisis management covers only the second and promises that AI will predict crises before they happen.

That’s the wrong emphasis for 2026. The threat side moved faster than the tool side. Attackers are using AI to compress the time between first access and real damage from weeks to hours, while most crisis and business continuity plans still assume days.

My position is simple. AI is a resilience amplifier, not a replacement. It makes a good team faster and a bad process fail faster. Here’s what that means for crisis management and business continuity teams on both sides of the ledger.

AI as the Threat: What Changed

The response window collapsed. Anthropic’s September 2026 threat intelligence report documents eight months of AI misuse it detected and shut down on its own platform. One stolen developer token became full cloud administrator access in about three hours. One compromised SaaS provider yielded data from roughly 200 downstream customers in about 34 hours, with AI agents doing most of the work. The techniques were old: stolen credentials, unpatched systems, phishing. The speed was new. I wrote about what that does to your plan in The Response Window Just Collapsed.

The AI vulnerability storm. AI models now find and chain software vulnerabilities faster than most organizations can patch them. When the AI labs and more than a hundred other organizations signed a collective warning this year, they focused on prevention. I covered what their letter left out: response and recovery. A storm of AI-discovered vulnerabilities breaks five assumptions most programs are built on:

• A patch exists before widespread exploitation.
• Change management can approve patches at its normal pace.
• You can assemble decision authority in time.
• You face one major incident at a time.
• Vendors patch on a known cadence and tell you first.

AI agents inside your processes. Organizations are putting AI tools and agents into production faster than they can govern them. In 2024, an AI meeting assistant joined a physicians’ meeting at an Ontario hospital through a stale calendar invite, transcribed discussion of seven patients’ health information, and emailed a summary to 65 people, some of whom no longer worked there. Nobody hacked anything. The tool did what it was built to do, in a room it should never have been in. Your AI Agent Is Now Part of Your Incident covers the four questions to answer before an agent touches a critical workflow: who can shut it off, what did it touch, when was the data last right, and what depends on it.

Deepfakes and disinformation. In early 2024, an employee at the engineering firm Arup’s Hong Kong office joined a video call with what looked like the company’s CFO and other colleagues. Every one of them was a deepfake. The employee sent about US$25 million in 15 transfers before anyone caught it, according to CNN. A fake video of your CEO announcing a recall, or a fabricated audio clip of an executive saying something ugly, will move faster than your approval chain for a response.

AI as a single point of failure. The more of your work runs through one AI platform, the more an outage at that provider becomes your outage. Most business continuity plans don’t list AI tools at all.

AI as a Tool for Crisis and Continuity Teams

The tool side is real, and teams that ignore it will fall behind. Here’s where AI earns its place today:

• First drafts of crisis communications. Holding statements, employee updates, and FAQ drafts in seconds, plus translation for a global workforce. A person still decides what you say.
• Business impact analysis (BIA) and plan work. Summarizing interview notes, finding patterns across hundreds of processes, drafting plan sections, and flagging dependencies nobody wrote down.
• Exercise design. Scenario narratives, injects, simulated news coverage, and social media posts that make a tabletop exercise feel real.
• Monitoring. Sorting the flood of news, weather, social, and threat intelligence so analysts spend their time on what matters, and separating routine noise from the start of a real incident.
• After-Action Reports (AARs). Turning exercise logs, chat transcripts, and decision records into a first draft the team can sharpen.

Here’s where it doesn’t belong: the decision. AI can gather information and recommend. It can’t hold authority, accept risk on behalf of the company, or face a regulator. The bigger danger is a false sense of security when leaders trust the algorithm over their own judgment. AI can also be wrong in a confident, persuasive voice, which is exactly the wrong failure mode in a crisis.

As I said on the podcast, AI can write the brief for a crisis situation, but you still have to be the one who reads the room and persuades the group. Keep a human in the loop on every decision that matters.

Three Questions Before AI Touches Your Resilience Program

Before you add an AI tool to your crisis or continuity program, ask three questions:

1. Does it improve resilience? Does it make the organization better able to keep delivering what matters, or does it just make a task faster?
2. Does it reduce recovery times? If it doesn’t shorten the time to restore a critical service or make a decision, it’s a convenience, not a capability.
3. Does it safeguard trust? With customers, employees, regulators, and your own executives. If it puts confident, wrong information in front of any of them, it costs more than it saves.

Govern it the way you govern any other risk: against your risk appetite, with clear ownership, and with a plan for when it fails. The NIST AI Risk Management Framework is a solid, voluntary starting point for the governance side. I talked through the help-or-harm tradeoff on Managing Uncertainty, Episode 306.

AI in Crisis Management and Business Continuity: Five Moves for the Next 90 Days

These are leadership decisions, not technology projects.

1. Put AI in your BIA. Add one question to every BIA interview this year: which AI tools or agents does this process rely on, and what do you do if they disappear tomorrow? Most BIAs are already out of date on this.
2. Pre-authorize the ugly decisions. Who can take a production system offline at 2 AM without a meeting? Who can geo-restrict a customer portal or revoke every API key in the tenant? Write it down, and build a decision quorum you can reach in 15 minutes, any hour of the day.
3. Measure your real emergency patch velocity. Not the policy number. Test how fast you can actually patch your full fleet, the way you’d test a disaster recovery plan.
4. Set an executive verification protocol. A call-back rule for any unusual request involving money or data, and a verification phrase agreed in person. No leader is offended by a verification call.
5. Exercise at AI speed. Run a tabletop where the first inject is “the data is already on a leak site” and the second arrives 40 minutes later. Watch where decisions stall. That stall is your real response time.

We ran exactly this kind of exercise in August 2026: an AI vulnerability storm tabletop for a leading healthcare technology company. Twenty-seven participants worked three moves in three hours against a fictional AI model that found and exploited vulnerabilities within hours of disclosure. The team made real protective decisions in the room, including geo-restricting a customer-facing portal, because the exercise forced the authority question before a real event did. Our AI crisis exercises are built around the same idea: a fictional model and fictional vulnerabilities, against your real vendors and your real tempo.

AI won’t run your next crisis. Your leaders will. The ones who come through it well will have decided, in advance, what they’ll do when the machine moves faster than the plan.

Keep Going

A few ways to go deeper if this was useful.

• Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
• Test your team at AI speed. Our AI crisis exercises put the AI threat in the scenario and your real decision-makers on the clock.
• Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
• Talk to us. Set up a call to think through your program with us.