On January 5, 2024, Alaska Airlines Flight 1282 was flying at 16,000 feet when a door plug blew off the Boeing 737 MAX 9 fuselage. The two seats adjacent to the opening were, by chance, unoccupied. That stroke of luck is the only reason this incident did not become another mass casualty event for Boeing, a company still recovering from two fatal crashes that killed 346 people.
Within hours, the story dominated global news coverage. Boeing’s stock dropped 18.9% in the following weeks, erasing more than $28 billion in market value. The FAA grounded all 737 MAX 9 aircraft with door plugs for three weeks, and Boeing’s already tarnished reputation took another severe blow.
Six months later, CrowdStrike experienced a different kind of crisis when a routine software update crashed approximately 8.5 million devices worldwide that were running Microsoft Windows. Airlines grounded flights. Hospital systems stalled. Banks went offline. Emergency services encountered critical failures. The incident eventually cost insurers an estimated $1.5 billion in payouts and triggered legal action, including a $500 million lawsuit from Delta Airlines.
These two cases are instructive for risk professionals as they reveal an important disconnect in crisis management: Both companies had crisis plans, but neither was prepared for how the story actually unfolded.
Why Traditional Crisis Planning Falls Short
Most crisis management frameworks focus on operational response. Identify the problem. Contain the damage. Restore normal operations. Communicate status updates. These elements matter, but they miss something crucial: The headlines move faster than your operations.
In the first hours of any major incident, your organization does not control what the public sees. Journalists, social media users, employees and competitors are all narrating the story while you are still assembling your crisis team. The narrative gap between what is happening internally and what is being reported externally can determine whether a crisis becomes manageable or catastrophic.
Boeing’s response to the door plug incident illustrates this problem. The company issued technically accurate statements, but those statements arrived after the public had already formed opinions. When CEO David Calhoun later told a Senate subcommittee he was proud of Boeing’s safety record, the comment became its own reputation event, reinforcing existing negative perceptions rather than shifting them.
CrowdStrike faced a similar challenge. CEO George Kurtz’s initial statement identified the problem and described who was impacted, but it did not include an apology. That omission became the story, overshadowing the company's rapid technical response. As one communications executive observed, the first statement that travels widely shapes what people remember.
Implementing the Red Team Model
Military organizations have long used adversarial simulations to stress-test their strategies. The concept, commonly referred to as “red teaming,” involves assigning a group to challenge plans by thinking like an opponent. The red team’s job is to find weaknesses before actual adversaries do.
In the context of reputation risk, red teaming means testing crisis responses against realistic media scenarios before those scenarios become reality. The goal is not to predict exactly what will go wrong. The real objective is to build organizational muscle for managing the narrative dimension of any crisis.
Traditional tabletop exercises ask: Can we execute our operational response? Red team exercises ask a different question: What will the first 48 hours of media coverage look like, and are we prepared to compete for narrative control?
The Competitive Edge
Reputation risk management is not neutral. Your competitors are also managing their narratives, and a crisis for one company can become an opportunity for another. During the CrowdStrike outage, Microsoft’s communications team worked to ensure customers and media understood the problem originated with CrowdStrike, not Microsoft. That positioning was strategically sound, but it also meant CrowdStrike was fighting for narrative space against a much larger company with stronger media relationships.
Red team exercises should include this competitive element. How will your competitors describe your crisis? What will they say to your shared customers? How will you maintain relationships with stakeholders who are hearing alternative narratives?
Designing a Red Team Exercise
An effective reputation red team exercise requires different participants, scenarios and success metrics than a standard crisis drill.
1. Deciding on Participants
Start with the participant list. Traditional exercises often include operations, legal and communications staff. A red team exercise should consist of individuals who can authentically simulate external pressure, such as a skeptical journalist posing challenging questions, a social media commentator generating realistic commentary or a representative of an analyst or investor who is concerned.
These roles can be filled by internal staff from other departments or by external consultants, but they need enough distance from the crisis team to provide genuine pushback.
2. Detailing Realistic Scenarios
Next, construct scenarios that prioritize narrative complexity over operational complexity. The most useful exercises involve situations where the facts are ambiguous, stakeholder interests conflict or the company bears partial but not sole responsibility for the outcome.
CrowdStrike’s crisis is a good template. The company caused the problem, but the impact depended entirely on how customers had configured their systems. Who is the villain in that story? The answer depends on who tells it first.
3. Making Timelines Matter
Build your scenario timeline around media cycles. For example, the first impact might be a reporter calling for comment before you have confirmed basic facts. The secondary impact might be a viral social media post from an affected customer, and the third might be a competitor’s statement expressing sympathy while subtly highlighting their own practices.
Each additional obstacle forces the team to decide: respond now with incomplete information, or wait and risk losing narrative control?
Running the Exercise
The mechanics of the red team exercise matter less than the pressure. Some organizations use detailed scripts with timed injections delivered through realistic channels. Others prefer a more fluid approach where facilitators adjust the scenario based on participant responses. Both can work as long as the exercise creates genuine decision points with real stakes.
During the exercise, make sure to document everything. Recording allows teams to review their decision-making process afterward, identifying where they hesitated, where they made assumptions that proved wrong, and where internal disagreements slowed response time.
After the Exercise
After the scenario concludes, conduct a structured debrief that focuses on three key areas:
- Review the statements produced during the exercise. Read them aloud and consider how they would sound to someone without inside knowledge. Check whether they answered the questions stakeholders would actually ask or only the questions the company wanted to address.
- Examine decision-making speed. Crisis communication often requires accepting 80% confidence rather than waiting for certainty. Teams that struggle with this trade-off typically reveal the problem during exercises.
- Assess coordination. Who had the authority to approve statements? Were the right people in the room? Did legal and communications work together productively, or did review processes create bottlenecks?
What Red Team Exercises Reveal
Organizations that run these exercises regularly report several common findings.
Many discover that their holding statements are too generic to be useful. Phrases like “We take this matter seriously” or “We are investigating” do not satisfy anyone. Effective holding statements acknowledge specific stakeholder concerns and commit to specific follow-up actions.
Some find that their spokespeople lack practice in handling hostile questions. Reading a prepared statement is different from responding when a journalist asks why customers should trust you after an incident. That skill requires rehearsal.
Others learn that their escalation procedures work well for operational decisions but poorly for communication decisions. A CEO may need to appear on camera within hours of a major incident. If the organization has not defined what triggers executive visibility, the decision-making process can become too slow.
Building Institutional Capability
One-time exercises can produce insights, but regular exercises build capability. Organizations that integrate red team scenarios into their annual calendar develop teams that respond to actual crises with practiced reflexes rather than improvised guesswork.
Consider scheduling exercises at different scales. Quarterly tabletop discussions may involve only the core crisis team and focus on specific skill areas, such as message development or media interview techniques. Annual full-scale exercises could involve senior leadership, external facilitators and scenarios that span multiple days of simulated time.
Rotate scenario types to cover different risk categories. Some should address operational failures, such as product defects or service outages. Others should explore external events such as regulatory investigations or activist campaigns. You could also add exercises that test responses to leadership crises, such as allegations of executive misconduct or sudden departures.
After each exercise, update your crisis playbook based on what you learned. The playbook should include layered holding statements that can be adapted to different incident types, pre-approved messaging frameworks, clear escalation criteria and contact information for external resources that you may need to rely on under pressure, such as crisis communications firms.
How to Get Started
If your organization has not conducted a reputation red team exercise, begin with a focused scenario involving an incident that has actually affected a peer company. Use public reporting about that incident to construct a realistic timeline. Gather a small group of participants and work through the first 24 hours, producing actual draft statements rather than simply discussing what you would do.
This initial exercise will reveal gaps in your current preparedness. Use those findings to design a more comprehensive exercise with broader participation. Over time, build toward exercises that stress-test your organization’s ability to manage not just what happened, but what people believe happened.
The companies that navigate crises most effectively share a common trait: they practice. Not just operational response, but narrative response. They thought about headlines before the headlines arrived. That preparation cannot guarantee a good outcome—some crises are genuinely uncontrollable. However, it can mean the difference between a crisis that damages your organization and one that defines it.