Newsroom · Eterna-owned guide
The Executive First Hour Response Playbook
A condensed playbook for executives and communications leads: the decisions that matter most in the first hour, before the fuller response process begins.
When a deepfake or impersonation incident touching an executive or organization surfaces, the pressure to respond immediately is real, and it's usually the wrong instinct. The first hour is not for solving the problem. It's for not making it worse while the fuller process (covered in the Impersonation Response Guide) gets underway.
Move 01
Do not respond publicly yet
A denial, a joke, or an acknowledgment posted in the first hour can lock in a framing before you know what you're dealing with. Silence for one hour is rarely costly. A wrong first statement is.
Move 02
Assign one owner
One person (not a group chat) owns evidence capture, internal updates and the incident log: a running, timestamped record of what's known, what's been done and who authorized it. Split ownership is how details get lost or contradicted later.
Move 03
Capture evidence before anything moves or disappears
Full-context screenshots or recordings, direct links, timestamps and visible reach. This is the single highest-leverage action available in the first hour, and the easiest one to skip under pressure.
Move 04
Loop in legal and communications together, not sequentially
A fraud, threat or public-figure exposure angle changes what can be said publicly and what should go to a platform or authority first. Deciding that alone, without both functions in the room, is how avoidable mistakes happen.
Move 05
Decide what you actually know, versus what you suspect
Write down the difference explicitly. Nothing gets called 'confirmed fake' or 'AI-generated' externally until it clears a real verification standard. See the linked guide below for what that requires.
What "done" looks like after hour one
Not a public statement. Not a resolved case. Done looks like: evidence preserved, one owner assigned, legal and comms both briefed, and an incident log with a clear, written line between what's confirmed and what's still being assessed. That's the handoff into the fuller response process: there's no fixed length for how long that takes; it runs until the incident is resolved.