In a financial crisis, customers ask three questions and they ask them immediately: what happened, is my money safe, and what happens now. Our crisis simulation for a financial services provider, built on 90 days of listening plus 18 customer user tests, found that customers wanted those answers inside 30 minutes. The provider's simulated response began at 2 hours. The study closes with the protocol that brought it down to 28 minutes.
I Discrimen
The first statement and the full explanation are two different products
A holding answer buys trust, and the investigation buys it back later at a higher price.
Our user tests drew a distinction that crisis plans often blur. Customers did not expect a complete account of an incident within half an hour, and the tests suggest they would have distrusted one. They expected acknowledgement, a direct answer on whether their money was safe, and a statement of what would happen next, all within 30 minutes.
The full explanation belongs to a later hour, once facts are verified and remedies exist. Treating the two products as one is how organisations end up silent at the moment of maximum anxiety, polishing a complete account while customers conclude that silence means the worst.
Providers serving account holders at scale face this in its sharpest form, and the planning questions in choosing a PR agency for banks run into the same wall. The first half hour is a customer protection exercise conducted in public. Everything after it is reputation work.
Say what you know, say what it means for the customer, and say when you will return.
II Machina
Ninety days of listening and 18 user tests set the standard before we timed anything
We learned what customers needed first, and only then measured how fast the provider could deliver it.
The study began with 90 days of listening across service channels and public conversation, which surfaced the questions customers actually ask when money feels at risk. We then ran 18 customer user tests, walking participants through simulated incidents and recording what they wanted, in what order, and by when.
That order matters. A response time target invented in a planning room reflects internal comfort, not customer need. Our tests produced the 30 minute expectation from the receiving end, which made it a standard the provider had to meet rather than a preference it could negotiate.
The standard can be set against the benchmarks in our research record, which puts the Crisis First Response benchmark median at 60 minutes and the top quartile at 25 minutes. A target earns its place by comparison with reference points like those, not by assertion from the team that has to meet it.
Measure the need before you time the response.
III Exemplum
Customers named three questions and a 30 minute window
The study itself is small and practical: listen first, test with customers, then run the clock.
The listening phase and the 18 user tests converged on the same three questions, in the same order. What happened came first, because customers wanted to know the event was understood. Is money safe came second, because it is the question every other answer depends on. What now came third, because customers wanted an action and a time for the next update.
| Measure | Simulation study | Benchmark median | Benchmark top quartile |
|---|---|---|---|
| Customer expectation for first answers (minutes) | 30 | Crisis First Response 60 | Crisis First Response 25 |
| Customer user tests completed | 18 | Not benchmarked in the record | Not benchmarked in the record |
| Listening period before testing (days) | 90 | Not benchmarked in the record | Not benchmarked in the record |
| Simulated response before the protocol | 2 hours | 60 minutes | 25 minutes |
| Simulated response after the protocol (minutes) | 28 | 60 minutes | 25 minutes |
fons: Aerovector research record for the study figures and the Crisis First Response benchmarks in this table.
Read the final figure against the benchmarks with care. At 28 minutes, the provider's simulated response moved from far outside the range to inside the median and close to the 25 minute top quartile. It did not beat the top quartile, and this post does not claim otherwise.
A standard set by customers is harder to argue with than one set by a committee.
IV Damnum
Silence in the first hour is read as an answer, and it is the worst available one
Customers fill an information vacuum with the most frightening plausible story.
The cost of a 2 hour response is set by the environment customers now live in. The Federal Reserve reported in 2025 that 21 percent of adults had experienced financial fraud or scams in 2024, so a large share of any customer base has already rehearsed the fear that their money is being taken. SecurityWeek reported in 2025 that consumer losses to fraud topped 12.5 billion dollars in 2024, according to Federal Trade Commission data.
Against that background, unexplained silence does not read as diligence. The ABA Banking Journal reported in 2024 that roughly one in four Americans expressed a great deal or quite a lot of confidence in banks, based on Gallup's annual survey. Confidence that thin cannot survive a long, unexplained gap at the exact moment customers are asking whether their money is safe.
Every silent minute spends confidence the institution may not have in reserve.
V Genus
Account holders, borrowers, and business clients need the same facts in different orders
One incident produces several publics, and each starts from a different exposure.
Our tests separated customers into kinds by what an incident puts at risk for them. Account holders wanted the safety answer first and in plain terms, because deposits and payments are their daily infrastructure. Borrowers wanted to know whether obligations, rates, or applications were affected, and feared penalties arising from a failure they did not cause. Business clients wanted operational specifics: payroll, settlement, and what to tell their own customers.
A single statement can serve all three kinds if it is layered, with the shared facts first and kind specific answers immediately behind them. What fails is a statement written for the median customer, who does not exist during an incident. The segmentation habit in choosing a PR agency for credit unions reflects the same membership logic: people judge the response by what it means for their account, not by its average quality.
Regulators and journalists form a further kind, addressed in the thinking behind choosing a PR agency for insurance companies, where documented process matters as much as tone. Their questions arrive quickly too, and a provider that has rehearsed only the customer version will improvise the rest.
Write for the most exposed customer first, and layer outward from there.
VI Regio
The crisis is experienced on a phone screen and at a branch counter, not in a boardroom
Wherever a customer meets silence, that channel becomes the story.
A financial incident is lived in specific places: an app that will not load, a card declined in a queue, a branch line forming before opening. The provider's statement has to arrive in those places, in formats each channel can carry, or the fastest press release in the world changes nothing for the person standing at the counter.
The technical backdrop keeps raising the stakes. Verizon reported in its 2025 Data Breach Investigations Report that third party involvement in breaches had doubled to 30 percent, which means the incident a provider must explain may originate outside its own walls. The NIST Cybersecurity Framework gives organisations a shared structure for preparing for such events, and communication belongs inside that preparation rather than beside it.
Channel readiness is therefore part of response time, a point the teams assessing choosing a PR agency for cybersecurity will recognise from incident work on the technical side. A statement approved at minute 20 but invisible in the app until minute 90 is a 90 minute response, whatever the clock in the boardroom said.
Your response time is the slowest channel your customers actually use.
VII Occasio
A 30 minute holding statement protocol cut simulated response from 2 hours to 28 minutes
The gain came from decisions made in advance, not from people typing faster.
The PR action our study tested was a 30 minute holding statement protocol. Its elements were deliberately unglamorous: pre-drafted statement shells built around the three customer questions, named approvers with deputies, pre-agreed wording for the money safety answer at different severity levels, and a rule that the holding statement goes out on time even while facts are still being verified.
The protocol also fixed the update rhythm. Customers were told when the next update would arrive, and that promise was treated as part of the response, because a kept appointment rebuilds confidence while a missed one confirms the original fear.
The recorded outcome was the simulated response falling from 2 hours to 28 minutes. That result sits inside the 60 minute benchmark median and near the 25 minute top quartile in our record. It was achieved in simulation, which proves the organisation can do it under rehearsal conditions, and says nothing yet about a live incident at 3 in the morning.
Speed in a crisis is a design decision made months earlier.
VIII Structura
The holding statement has four moves and no adjectives
What happened, whether money is safe, what happens now, and when you will hear from us again.
Structure is what makes the protocol repeatable under stress. The opening move acknowledges the event in concrete terms, without speculation about cause. The second move answers the safety question as directly as verified facts allow, and says plainly when it cannot yet be answered. The third move gives customers their action, if any, and the provider's next step. The fourth move names the time of the next update.
| Clock | Move | Owner |
|---|---|---|
| Minutes 0 to 10 | Confirm the incident and activate the protocol | Duty officer |
| Minutes 10 to 20 | Draft from the pre-approved shell, verify the safety wording | Communications lead with operations |
| Minutes 20 to 30 | Approve and publish the holding statement on every customer channel | Named approver or deputy |
fons: Aerovector research record for the 30 minute expectation and protocol; timings are this post's breakdown of the tested protocol.
Notice what the structure forbids. It forbids adjectives about the provider's commitment, speculation about blame, and any promise about resolution time that operations has not confirmed. In a holding statement, restraint is not caution for its own sake. It is how the statement stays true when the facts finish arriving.
A short true statement beats a long one that needs correcting.
IX Consilium
Rehearse the protocol, pre-approve the wording, and time the rehearsal honestly
The prescription is preparation with a stopwatch, repeated until 28 minutes feels ordinary.
Begin by listening, as we did: 90 days of your own service and public channels will tell you the questions your customers will ask, and user tests will set the window they expect answers within. Set your result against the Crisis First Response benchmark median of 60 minutes and top quartile of 25 minutes from our record, so the board sees the gap in comparative terms. The disciplines involved are mapped in our public relations services.
Build the protocol before the next incident chooses your timing for you. Pre-draft the shells, name approvers and deputies, agree the safety wording at each severity level, and check that every customer channel can publish at the same speed. Teams in choosing a PR agency for Fintech face the same requirement in product form, since app based providers have no branch network to absorb confusion in person.
Then simulate, and time it without kindness. Our study's movement from 2 hours to 28 minutes only became visible because both runs were timed. An untimed rehearsal produces confidence. A timed one produces a number you can improve.
Rehearsal is where a crisis plan stops being a document.
X Quaesita
Questions
What did the crisis simulation study actually do?
We combined 90 days of listening with 18 customer user tests, then timed simulated incident responses. The tests established what customers wanted answered, and in what order, before the provider's response speed was measured against those expectations.
What do customers want within 30 minutes?
They wanted three things: what happened, whether their money is safe, and what happens now. They did not expect a complete explanation of the incident in that window. They expected acknowledgement, a safety answer, and a next step with a time for the following update.
How do the benchmarks frame the result?
Our record sets the Crisis First Response benchmark median at 60 minutes and the top quartile at 25 minutes. The provider's final simulated time of 28 minutes sits well inside the median and close to the top quartile, without beating it.
What is the 30 minute holding statement protocol?
It is the PR action tested in the study: pre-drafted statement shells built around the three customer questions, named approvers with deputies, pre-agreed safety wording by severity, and publication within 30 minutes even while facts are still being verified.
How did response time fall from 2 hours to 28 minutes?
The improvement came from decisions taken in advance rather than faster work on the day. Drafting, approval, safety wording, and channel publication were all settled before the simulation clock started. The remaining time went on verification of the few facts the statement actually asserts.
Does a simulated result prove the provider can do this live?
No, and we present it as a simulation result only. It proves the protocol works under rehearsal conditions with the people and channels tested. Live incidents add absence, escalation, and third party complications that only repeated simulation can prepare for.
How often should the protocol be rehearsed?
Often enough that the 28 minute performance stays ordinary rather than exceptional, and whenever approvers, channels, or products change. Each rehearsal should be timed, because an untimed run cannot show whether the standard is being held.
How this guide was built
This post reports Aerovector's own research record for a crisis simulation study for a financial services provider: 90 days of listening plus 18 customer user tests, the three questions customers wanted answered within 30 minutes, the Crisis First Response benchmark median of 60 minutes and top quartile of 25 minutes from that record, the 30 minute holding statement protocol as the PR action, and simulated response falling from 2 hours to 28 minutes as the recorded outcome. The study figures are Aerovector's own research record, and identities are withheld, so the organisation is described only as a financial services provider. The outcome was achieved in simulation rather than a live incident, the user test sample is small by design, and its benchmarks come from the same research record. Third party sources were used only to set context on fraud prevalence, confidence in banks, and breach patterns, and each is named with its year where it appears.
Sources
- Aerovector, Crisis simulation research, 2026: the first-party study reported in this post, figures from the practice research record, identities withheld.
- FDIC, survey finding 96 percent of U.S. households were banked in 2023, press release, 2024. https://www.fdic.gov/news/press-releases/2024/fdic-survey-finds-96-percent-us-households-were-banked-2023
- Federal Reserve, Economic Well-Being of U.S. Households in 2024, reporting 21 percent of adults experienced financial fraud or scams, 2025. https://www.federalreserve.gov/publications/2025-economic-well-being-of-us-households-in-2024-executive-summary.htm
- ABA Banking Journal, survey coverage reporting roughly one in four Americans with a great deal or quite a lot of confidence in banks, 2024. https://bankingjournal.aba.com/2024/07/survey-u-s-public-confidence-remains-low-for-banks-other-institutions/
- SecurityWeek, reporting Federal Trade Commission data that consumer fraud losses reached 12.5 billion dollars in 2024, 2025. https://www.securityweek.com/fraud-losses-reached-12-5-billion-in-2024-ftc/
- IBM, 2025 Cost of a Data Breach research and analysis. https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai
- Verizon, 2025 Data Breach Investigations Report, reporting third party involvement in breaches doubling to 30 percent, 2025. https://www.verizon.com/about/news/2025-data-breach-investigations-report
- National Institute of Standards and Technology, Cybersecurity Framework, preparation and response structure. https://www.nist.gov/cyberframework
- Cybersecurity and Infrastructure Security Agency, ransomware guide covering incident response preparation. https://www.cisa.gov/stopransomware/ransomware-guide
- Federal Reserve, Financial Stability Report, monitoring of risks across the financial system. https://www.federalreserve.gov/publications/financial-stability-report.htm
XI Incipe
When your customers allow you 30 minutes, Aerovector builds the protocol that answers in 28
Our Message House work turns the three customer questions into pre-approved statement shells, and Newsroom Calendar discipline keeps approvers, deputies, and channels rehearsed against the clock. Coverage Reporting then reviews every simulation and every live response against the same standard, so the number improves because the preparation improves, not because the incident was kind.
That is the ground the practice works from: Aerovector ranks clients for AI search results, guarantees their media coverage, and treats the leads that follow as the point of both. For a financial services provider, a clear and fast public record matters doubly, because the account of an incident that search tools surface later is written in its first hour. If your own simulated response is still measured in hours, send us your current draft holding statement and the channels it must reach through the form on our contact page, and we will show you how a timed protocol would be built.
Aerovector prepares the first answer before the incident chooses the moment.
Send your draft holding statement through the contact form for a timed protocol review
Additional Details
Description: Our Research: Crisis simulation for a Financial services provider: what the study measured, what it found, and what the finding changes for teams facing the.
Published: 2026-10-25