Crisis in practice
The golden hour of a cyber crisis, and the six steps that decide it
In trauma care the first hour is called the golden hour. Not because anything brilliant happens, but because the sequence is fixed and nobody has to ask whether they are allowed. On 21 October 2026 two critical vulnerabilities in PHP became public, with working exploit code and no patch. Dozens of organisations had hours to decide whether to take themselves offline. This paper walks through that afternoon along six steps, and shows where such an hour actually breaks: not on technology, but on authority.
No registration required. No mandatory email address.
The six steps
BOBOC
On 21 October 2026, during a critical vulnerability in PHP
- BPicture. What happened?Do we run PHP, which version, and where is it exposed to the internet? On 21 October many organisations could not answer that within an hour.
- OJudgement. What does it mean?Working exploit code, no patch yet. Unavailability against the chance of a break-in.
- BDecision. What are we going to do about it?At 13:35: everything offline preventively, until the update lands.
- OOrder. Who is going to do it?By 14:30 it was done. From decision to carried out in fifty-five minutes.
- CCheck. Has it been done?Over the evening the new PHP versions were rolled out and the sites came back.
The sequence used in Dutch crisis management: forming a picture, forming a judgement, taking a decision, issuing an order, checking.
Why this is not about skills
Behaviour under pressure has been thought about well, and better papers than this one have been written about it. We look at something else, a layer underneath: not how the team behaves, but what happens to the decision. Who took it, who carried it out, and whether anyone checked. That is not a property of people but of the chain between them, and that chain can be timed.
In OT, stopping is a different decision
In an office environment the heavy decision is usually whether to restore now or preserve evidence first. In a plant another decision arrives that is of a different order: may the installation keep running. That touches safety, it touches delivery, and it sits with someone other than the CISO.
What the law asks of this
The Dutch Cyberbeveiligingswet puts approval of the measures with the board and asks every board member for knowledge of risks, measures and their consequences for the entity's own services. The paper sets out what the law literally asks and what it does not, with the article numbers.
Live through it once
The trail reads easily. Where it breaks only shows once something has to pass through it. That is what our crisis exercises are for.
See the crisis exercises