Online reputation management
The remediation work that follows containment.
Read morePractice area 03
Crisis management and crisis communication
Allegations, leaks, litigation, activist campaigns, coordinated attacks and the story that breaks on a Friday evening. Incident command for principals who cannot afford to improvise.
Why speed decides it
The first version becomes the permanent version.
Search engines weight early, well-linked coverage heavily, and language models are trained on what search surfaced. Whatever gets published in the first forty-eight hours becomes the canonical account — and then every later piece cites it.
Which is why the most expensive thing you can do in hour one is say something you have to walk back in hour six.
Incidents we handle
- Allegations of misconduct, personal or professional
- Regulatory action, investigations and enforcement notices
- Litigation with a media dimension
- Leaked documents, private messages and hacked material
- Coordinated attacks — competitor-funded, activist or extortion-driven
- Employee, partner or family disputes going public
- Deepfakes, impersonation and fabricated quotes
- Association risk: a counterparty's crisis becoming yours
Protocol
The first 48 hours
Same sequence every time. The sequence is the point — improvisation is what turns an incident into a story about the response.
Hour 0–1
Contact and containment
Crisis line answered. We establish what is actually true, not what is being alleged. Everyone on your side stops commenting — internally as well as externally, because internal notes leak.
Hour 1–6
Mapping
Origin, amplification path, indexing status, and whether the spread is organic or bought. Legal exposure assessed in parallel with counsel, not after them.
Hour 6–24
Position and publish
One agreed position, in one set of words. Owned statement live on your own domain and structured for search. Board, investor, staff and press comms aligned to the same language.
Hour 24–48
Displace and correct
Removal requests where grounds exist. Corrections pursued with publishers. Authoritative assets pushed hard so the record settles in the order you can live with.
Week 2–12
Rebuild
The incident becomes the smallest item on page one. Monitoring stays on. Protocol stays warm for the recurrence, because these things frequently recur.
Retained readiness
Most of this work is done before anything happens.
Clients on retainer already have holding statements drafted, a dark site ready to publish, a named decision-maker, and a monitoring net that flags something at 3am. The difference between a prepared principal and an unprepared one is usually about thirty hours — which is the whole game.
What a retained protocol includes
- Scenario mapping against your actual exposure, not a generic list
- Pre-approved holding statements for each scenario
- A dark site that can be published in minutes
- A single named decision-maker and a documented escalation chain
- Media and hostile-question training for the principal
- 24/7 monitoring across search, social, forums and answer engines
- An annual live simulation, unannounced
Common questions
Straight answers
Something is happening right now. What do I do first?
Contact us and stop commenting anywhere until we have spoken — including in internal channels. Preserve everything: screenshots, URLs, timestamps, message threads. Do not delete anything, and do not have anyone on your team respond in comments. We will be on a call within the hour.
Do you work alongside our lawyers?
Always, and the earlier the better. Legal strategy and communications strategy fail when they run separately — the classic failure is a legally immaculate statement that reads as an admission, or a sympathetic statement that creates a liability. We work in the same room.
Can you stop a story from being published?
Occasionally, where it is factually wrong and we can demonstrate that to the editor before publication. More often the achievable outcome is a more accurate story with your position properly represented, which is worth considerably more than a fight you lose loudly.
What if the attack is coordinated and funded?
Then it is an investigation as much as a communications matter. We map the network, document the pattern, and build the evidence file your counsel needs — while running containment in parallel. Coordinated campaigns leave fingerprints, and those fingerprints are often the fastest route to ending them.
Private enquiry
If it is live, say so in the subject line.
Live matters are triaged first and answered within the hour, including weekends and public holidays.