AI
Strategic Communication as Incident Response Infrastructure
The CrowdStrike outage on July 19, 2024 took down 8.5 million computers. The technical cause was documented fast. What Josephs kept asking was different: who stood in front of the cameras, and what did they say? That question pulled her into ransomware negotiation, crisis management, and communication analysis, treating language as a threat vector.
Her argument: strategic communication is not a PR skill. It belongs in the incident response plan. How narratives are built, how tone signals credibility, and how words hijack attention are attack surfaces. Studying them is how defenders detect and counter attacks that leave no network trace.
How Cognitive Biases Make Humans Predictably Exploitable
In the Kiki/Boba audience exercise (04:31), 90% of the room assigned the same shape to “Kiki” without prompting. The brain links sound, shape, and emotion automatically. Attackers pick words and visuals that trigger trust or panic on that reflex. The Stroop effect live demo (06:06) showed the same mechanism under load: reading “blue” printed in red ink produces hesitation. Under stress, people click before they check. A third exercise, judging which face looked like a cybercriminal, demonstrated the halo effect: one visible trait rewrites the whole assessment. These are features of the human mind.
“technology can protect systems but strategic communication can protect the trust”
Anatomy of Attacker Manipulation in Ransomware Chats
Josephs spent months reading real ransom chat transcripts. Attacker openings are short: a proof snippet, a demand, a 48-hour deadline. Victims reply with panic and questions. That reaction is what the attacker expects.
“It is not about files and keys. It is pure psychology.” — Alexa-Ștefana Josephs
The toolkit repeats across transcripts: urgency deadlines, astronomical opening demands, one sample file returned to manufacture goodwill, and isolation — one panicked contact, away from legal. Negotiators dismantle these levers by slowing the tempo, centralizing to a single official voice, and demanding verifiable proof.
“that change from panic to process. It is the single most powerful thing and the most powerful move you can see when while reading ransom chats” — Alexa-Ștefana Josephs
Because
“language is leverage” — Alexa-Ștefana Josephs
Structure pulls power from the attacker’s threat. Once they must convert narrative into verifiable outcomes, they are weakest.
Live Ransomware Negotiation Roleplay
Josephs ran the AI attacker bot negotiation — audience volunteers (17:21) using a ChatGPT prompt trained on real ransom chat transcripts. Asking whether the price was negotiable got nothing. Claiming no cash and needing a week to raise $500,000 got a wait. Disclosing offline backups the attacker didn’t know about got a 15% price reduction. One student tried claiming he was in the hospital and asked the bot for $500,000 to pay the ransom with; the bot agreed, forcing a prompt rewrite.
Communicators Belong Inside the Incident Response Team
Strategic communication is a core part of the incident response plan, not a PR function. Communicators belong inside the team, running parallel to the technical response from the first minute. Companies that learned this the hard way watched employees say the wrong thing on social media and damage the brand faster than the breach itself did.
The practical fix: train technical people to communicate under pressure. Getting an engineer to speak clearly to a board or a press contact is faster than training a spokesperson to understand the attack.
Q&A
Where can we find your GitHub with that code? She said she would post the prompt on her LinkedIn that day or the next, directing people to check her profile there. ▶ 26:58
What’s your recommendation to companies — train your own responders on negotiating, or always bring in a trained external company? She recommended training your own technical people to communicate clearly, arguing it is faster to teach engineers to speak plainly than to teach communicators to understand technical depth. ▶ 27:29
Notable Quotes
It is not about files and keys. It is pure psychology. Alexa-Ștefana Josephs · ▶ 11:52
that change from panic to process. It is the single most powerful thing and the most powerful move you can see when while reading ransom chats Alexa-Ștefana Josephs · ▶ 12:44
language is leverage Alexa-Ștefana Josephs · ▶ 13:02
technology can protect systems but strategic communication can protect the trust Alexa-Ștefana Josephs · ▶ 10:00
Key Takeaways
- Attackers exploit urgency, anchoring, and isolation — trained negotiators dismantle each lever methodically.
- Shift communication from panic to process the moment an incident begins; that shift is your first act of leverage.
- Train technical staff to communicate under pressure — it is faster and more effective than training communicators to become technical.
About the Speaker
Alexa-Ștefana Josephs
Cybersecurity communication expert with a background in psychology and strategic communication. Currently a PhD student. Her work focuses on the human layer of cyber threats — from behavioral awareness campaigns to the psychology of ransomware negotiations. A proud member of Women4Cyber Romania and an aspiring university professor, she brings a unique perspective to the field by blending social engineering expertise with a deep understanding of human behavior. Alexa is passionate about helping both users and organizations navigate digital risks with clarity, empathy, and impact.