Why Crisis Communicators Are Preparing for the Wrong Threats: BCI Horizon Scan Report 2025 Analysis

The Business Continuity Institute's 2025 Horizon Scan Report exposes a dangerous misalignment. Practitioners fear cyberattacks above all else, with a Risk Index of 7.37. Reality tells a different story.

Safety incidents topped actual disruptions with a Risk Index of 14.64—nearly double what cyberattacks delivered. Extreme weather events caused 13.3% of all disruptions. The chart of cumulative disruptions since 2020 shows health and safety dominating the landscape.

The perception paradox is stark. What keeps us awake at night isn't what's actually hitting organizations during daylight hours.

Safety incidents lead actual disruptions at 14.64. But they rank only #16 in perceived future risks at just 3.61.

Health incidents score 7th in actual disruptions (11.61) but fall to 19th in future concerns (3.18).

Meanwhile, cyberattacks—practitioners' top concern—score nearly half in the actual disruption index compared to safety incidents.

According to the BCI Horizon Scan Report 2025, this gap creates a dangerous blind spot for communicators. Organizations develop robust, complex plans for advanced persistent threats and coordinated disinformation campaigns. Brilliant work, truly.

But what exists for the safety incident that takes out a critical team member? What's the communication plan when flash flooding closes the distribution centre? Too often, it's a generic template from 2016 that begins with "We regret to inform you..."

The BCI report states this bluntly: even "minor" accidents carry operational impact requiring immediate, empathetic internal communication and clear external narratives explaining service changes.

For communicators, the perception gap is brutal. We've meticulously planned for digital threats while physical disruptions get dusty templates.

Physical safety incidents demand a different communication approach than cyber incidents. They're immediate. Visible. Personal.

When someone gets injured, it's a failure to protect the organization's most vital asset—its people. We're the ones explaining that failure to everyone who matters.

The BCI report makes the case for specific emergency communications plans for physical safety incidents and regional extreme weather events. Edge cases? Not anymore. They're topping the disruption charts for the first time since 2017.

Crisis communicators must lobby risk teams to develop dedicated protocols now, not during the next flood or workplace accident.

When disruption hits, consequences ripple outward predictably. Customer complaints reach 43.2%. Loss of productivity hits 41.9%. And here's the one nobody discusses enough: negative impact on staff morale, wellbeing, and mental health at 35.8%.

That productivity loss? It has less to do with systems being down than with people being overwhelmed.

The BCI report notes that disruption leads to increased stress when internal expectations remain high whilst resources and support lag behind. Organizations ask people to maintain performance during chaos without giving them the information, tools, or psychological safety to do so.

Crisis communicators face a dual mandate we can't dodge. First, protect the organization by managing the external narrative. Second, protect the people by managing internal anxiety. Two halves of the same job.

The report includes a sobering observation about resilience professionals themselves.

The constant rush to meet audit requirements—NIS2, DORA, all the regulatory alphabet soup—alongside managing actual cyber threats creates stress levels affecting their own engagement and effectiveness.

If the people responsible for organizational resilience are struggling with burnout, the entire system is built on sand.

Internal communicators must step up. Transparency means providing clear, timely updates during crisis to reduce uncertainty. Resources means immediately signposting mental health and support services, not three days later when HR gets around to it.

Empathy means acknowledging the physical and mental cost of ongoing instability, not just sending another "we're all in this together" email. Internal comms needs to evolve from HR's message relay to full crisis management team member.

Modern resilience exists in a web of dependencies. The BCI report confirms what we know from bitter experience: that web is a massive vulnerability.

Third-party failure caused 9.3% of disruptions. Critical infrastructure failure accounted for 8.6%. As global instability mounts and resource reliability becomes uncertain, these interdependencies grow as risks.

The problem for communicators is brutally simple. When crisis stems from a supplier or utility provider, your organization is simultaneously victim and primary information source.

Customers don't care that your supplier failed. They care that your service is down, and they want to know what you're doing about it.

The communication task becomes immensely complicated. You must own the problem even though you didn't cause it. You must manage expectations clearly, articulating cascading impact and steps being taken, even when those steps involve external parties you can't control. And you must do this whilst maintaining credibility.

Communicators need access to procurement and risk teams' supply chain mapping before failures happen.

We need to know who the critical suppliers are. We need to understand which dependencies carry highest reputational risk.

The BCI Horizon Scan Report 2025 notes that external parties are major concerns because complex interdependencies quickly reduce visibility over risk.

Mapping reputational dependencies associated with each critical supplier lets us answer the question that matters: if Supplier X fails, how do we explain this to our most vulnerable customers? What's the narrative? What's the timeline? What's the alternative?

Do this work now, not during crisis.

The long-term outlook in the BCI report (five to ten years out) confirms digital risk remains top of mind, but new systemic threats emerge fast. For communicators, this means starting scenario planning today for crises we've never managed before.

Digital dominance persists—cyber security remains the overwhelming long-term concern at 63.6%, nearly double climate risk.

AI emerges as new threat at 30.5%. This is the first time AI governance appears as a distinct future concern in the BCI report.

The human factor fades. Despite safety and health incidents dominating actual disruptions, mental wellbeing of staff registers only 11.9% and doesn't crack the top 10 long-term concerns.

Systemic threats compound: Climate (40.7%) plus geopolitical changes (28.8%) plus war and conflict (16.9%) equals a volatile operating environment where multiple crises intersect and cascade.

AI governance appears for the first time as clear future concern at 30.5%, trailing only cyber security and climate risk. The speed of AI adoption creates extraordinary opportunities and equally extraordinary exposure where governance lags behind implementation.

The question becomes: How do we communicate when the algorithm fails?

The report warns that processes are becoming heavily dependent on AI models, and organizations will struggle when outages occur. Workarounds need building into continuity planning now, because these models can and will fail.

Entirely new playbooks are needed. How do we explain AI-driven service outages to customers who don't understand the technology? How do we address data bias when it causes tangible harm? How do we communicate the use of AI in crisis management itself without triggering fears about depersonalization?

Climate risk sits at 40.7% in the long-term outlook, and this goes far beyond extreme weather events.

Drought. Resource scarcity. Sustained temperature changes affecting infrastructure, like data centres failing because cooling systems can't cope with consecutive 40-degree summers.

Communicators need to link sustainability messaging directly to resilience, explaining how investments in climate adaptation directly safeguard service continuity and staff safety.

This isn't environmental virtue signaling. It's operational necessity that requires sophisticated communication.

Geopolitical volatility registers at 28.8% with war and conflict at 16.9%.

These tensions intersect with everything—cyber incidents, supply chain failures, regulatory shifts, trade wars, tariff changes.

Explaining to stakeholders why a conflict thousands of miles away affects product pricing or delivery times requires sophistication that only the communication function can provide.

This is where communicators become strategic assets, not tactical support. We translate global complexity into local understanding.

Crisis communication exists to preserve credibility and value. The BCI report validates our necessity by demonstrating that operational disruption immediately becomes a communication challenge.

Look at the consequences of disruption: customer complaints, reputation damage (25.0%), increased regulatory scrutiny (14.9%), erosion of stakeholder and investor confidence (7.4%).

Effective, timely communication directly mitigates every single one.

The report also benchmarks the role of standards like ISO 22301, the leading framework for business continuity. According to BCI findings, 76.9% of organizations with certification cite the ability to demonstrate BCM programme effectiveness to external stakeholders as the primary benefit.

With new regulations like DORA coming into force, being able to communicate compliance and preparedness has become strategic necessity.

Communication as an afterthought no longer works. The BCI report shows threats merging across physical, digital, and human domains, which means response must be integrated.

Risk and BC professionals try to broaden their scope, but they need us. The top tools for trend analysis still rely heavily on human inputs: internal risk assessments, external reports, industry insight, participation in events, collaboration with peers. They're trying to connect dots themselves, often without the context we uniquely provide.

We monitor social media and track misinformation—precursors to activist campaigns and reputational attacks. We provide the "soft intelligence" that complements quantitative risk models.

We design exercise scenarios, ensuring they test the most realistic and high-consequence communication flows. A simultaneous IT outage and staff wellbeing crisis, not just the ransomware attack everyone's already planned for.

We also connect the dots, breaking down organizational fragmentation noted throughout the report.

The crisis communications strategy should function as the control tower that integrates all inputs and ensures coordinated response.

What is the biggest gap between perceived and actual crisis risks?

Safety incidents dominate actual disruptions with a Risk Index of 14.64 but rank only #16 in perceived future risks at 3.61. This represents the largest perception-reality gap in the BCI Horizon Scan Report 2025.

How should communicators prioritize physical safety incidents?

Develop specific emergency communications plans for physical safety incidents now, not during crisis. These plans need immediate, empathetic internal communication protocols and clear external narratives explaining service impacts.

What percentage of disruptions affect staff mental health?

35.8% of disruptions negatively impact staff morale, wellbeing, and mental health according to the BCI report. This demands proactive internal communication strategies that provide transparency, resources, and empathy.

How do third-party failures complicate crisis communication?

Organizations become simultaneously victim and primary information source when suppliers fail. Communicators must own the problem externally while having no control over the external party causing the failure, requiring sophisticated expectation management.

Why is AI governance appearing as a distinct concern now?

AI governance registers at 30.5% in long-term concerns because organizational processes are becoming heavily dependent on AI models while governance frameworks lag behind implementation. AI outages will require entirely new communication playbooks.

What's the relationship between climate risk and operational resilience?

Climate risk at 40.7% includes sustained infrastructure challenges like data centres failing due to prolonged high temperatures. Communicators must link sustainability messaging directly to operational resilience, explaining how climate adaptation investments safeguard service continuity.

How can communicators prepare for supply chain disruptions?

Map reputational dependencies associated with each critical supplier before failures occur. Determine the narrative, timeline, and alternatives for each high-risk dependency to enable rapid, credible communication during actual disruptions.

What role should internal communicators play in crisis management?

Internal communicators should be full crisis management team members, not HR message relays. This includes providing timely updates to reduce uncertainty, immediately signposting support services, and acknowledging the physical and mental cost of instability.

Business Continuity Institute. (2025). BCI Horizon Scan Report 2025. Retrieved from https://www.thebci.org/resource/bci-horizon-scan-report-2025.html

About the Author

Philippe Borremans is a crisis communication expert and founder of RiskComms consulting, specializing in crisis, risk, and emergency communication. He developed the Universal Adaptive Crisis Communication (UACC) Framework. His work focuses on modern crisis communication challenges including regulatory compliance, deepfake technology, audience fragmentation, and the intersection of AI with crisis response.