AI search keeps cyber breach history alive for brands

Sefiani has published research on how historical cyber breaches continue to shape company reputations in AI search results. The findings point to a stronger role for post-incident communications when customers ask AI tools whether a brand can be trusted.

The Australian communications agency, part of Clarity Global, examined how large language models and AI search products refer to past breaches as users move from general category research to specific purchase decisions. The analysis used data from Surfacd, the firm's AI visibility platform, and a survey of 1,019 Australian adults conducted by YouGov.

The study found that breach history appeared in just 2.7% of AI answers during broad category discovery, but in 42.2% of answers when users asked whether a specific brand could be trusted. For one of the three organisations examined, that figure rose to 59.1%.

All three case studies involved incidents resolved years earlier. Two of the organisations operated in business-to-business markets and one was consumer-facing.

AI sources

The research also tracked the sources AI systems relied on when generating answers. Corporate content, including company websites and owned channels, appeared in almost 90% of responses on average, while editorial media coverage featured in about 60%.

That matters because many organisations reduce public communication once the immediate crisis has passed. If their own explanation of the incident is limited or absent, AI tools may rely more heavily on older coverage and third-party commentary when summarising a brand's record.

"Consumer and B2B buyers are now increasingly trusting recommendations from AI answers as much as, or more than, advice from a brand representative. This changes what a cyber incident response needs to address," said Mandy Galmes, Managing Partner at Sefiani.

"Once the incident is resolved, organisations need to publish a clear, factual account of what happened, what they did and, importantly, what they have changed, on their own channels. This means AI has your own version of the incident. If this step is missed, AI will build the story and define your reputation for you, from whatever media coverage or third-party commentary appeared," Galmes said.

The consumer survey suggested public reaction to a breach is more nuanced than headline responses might imply. A third of Australians said they would stop buying from an organisation that had been breached, but among respondents who had actually been customers of a breached brand, roughly one in 10 said they had done so.

Sefiani's polling found that the most influential factor in keeping customers loyal after a breach was what the company did to prevent another one, cited by 39% of respondents. That ranked ahead of the seriousness of the breach and the type of information affected, both at 32%, and transparency about what happened at 30%.

Response plan

The findings suggest cyber incident planning now extends beyond technical containment and regulatory reporting. Communications teams are being pushed to think about how an incident will appear in AI-generated answers long after the event itself is closed.

Organisations should decide in advance how a ransom demand would be handled and communicated, treat internal communications as an early priority, publish a factual account of the breach and subsequent changes on owned channels, and continue monitoring how AI systems surface the brand, according to Sefiani.

The emphasis on internal communication reflects another risk during a cyber event: employees learning details from news reports before hearing from management. That can undermine trust inside the organisation and increase the chance of leaks or speculation shaping the wider narrative.

Shane Bell, Co-Founder and Chief Executive Officer of NSB Cyber, said the communications response now plays a central role in whether an incident is judged to have been handled well or badly.

"Good and bad cyber incidents used to come down purely to technical judgement. A bad incident is now more often than not one that was poorly communicated. Technology discussions tend to dominate the first 72 hours, when communications should be front and centre. Organisations that struggle are the ones least prepared to talk to regulators, suppliers, partners and customers," Bell said.

For communications advisers, the research adds to a growing debate about how AI systems recycle old reporting and corporate disclosures into new buying journeys. In that environment, the record an organisation leaves on its own channels may matter as much as the immediate crisis messaging delivered when the breach first becomes public.

The Surfacd analysis was based on about 30 prompts per brand across category discovery, brand validation and decision stages. It excluded prompts that directly mentioned cyber or data security and tested results across ChatGPT, Google AI Mode and Google AI Overviews.