B2B Crisis Communication That Protects Renewals: Seven Real Incidents and a Worked Save Plan

The incident happens in one week. The renewal comes when a buyer must sign to keep you, often beside a security reviewer who has never met your team. The first decision date can fall earlier: the last day to give notice of non-renewal.

I opened filings only for CrowdStrike, the one retention record here, company-reported. For the year to January 2025 it reports gross retention of "97% or higher in each quarter", though only two full quarters fell after the July 2024 incident, and net retention of 112%, against 119%, with no cause given beside the figures. The next annual report gives 115% and no specific reason, and states the lag: with terms "over one year, customer churn and any corresponding impact to our key metrics and revenue may occur in future periods." It says certain customers "terminated or chosen not to renew", and reports "delays in creating sales opportunities and longer sales cycles". Its customer commitment packages brought "increased contraction" and "decreased upsell dollar values". My reading, not the filing's: gross retention held and net retention recovered, while the cost sat in terms, upsell, cycle length and some lost contracts. One case is a lead, not a rule.

The other companies' posts give no renewal figures, so nothing here claims a message saved a contract. Those delays hit open deals too: keep a second list for open pipeline, with one security pack for both (written account, what changed, a current audit report or test letter).

Five moves: plan, tell, list, assess, talk. The judgment in each is yours and counsel's. Free tools draft two, and this example runs those two; Account health check, the baseline, is yours to run. Check every output as a first draft. The crisis planner drafts, from the crisis types you pick, who runs the response and what affected customers must hear. It cannot read your incident or your accounts, so check each playbook matches your crisis. Renewal save plan works account by account, from what you paste.

Customers come first, so the call and the written account go out before any list is worked. During a live incident, put no named accounts or incident facts into any AI tool unless counsel agrees, and leave any reuse of forensic findings in a note to counsel. The GUARD customer success guide covers routine renewals; this one covers the 180 days after an incident.

Incident communications: NCSC guidance | Impact, urgency and notification obligations: NIST SP 800-61r3, RS.MA-03 and RS.CO-02 | Sources opened 1 November 2026

Step 1. Draft the response plan, then check it

About this example. Retool is a real company. Retool has not reviewed this guide. Facts about Retool come from public sources, linked alongside with the date I checked them. Every other number, account, customer type and contract term is an illustrative input I chose; none is Retool's data, and the tool outputs are exercise results, not Retool's real strategy or a client result.

What is public, from Retool's post of 13 September 2023: on 27 August it "fell victim to a spear phishing attack", and on 29 August it "notified 27 cloud customers that there had been unauthorized access to their accounts". No on-prem or managed accounts were affected. The post argues that Google Authenticator's cloud sync weakened multi-factor protection; Google's reply, reported by BleepingComputer, was that users "have a choice" whether to sync. I take no side. I found no renewal figures from Retool.

Input to the crisis planner: company Retool, industry software, customer_base b2b_enterprise, business_model saas, potential_crises "customer_data_exposure, pr_incident". Three more are illustrative inputs, my choices and not Retool's data: data_sensitivity high_pii_financial, company_size midsize_200_1000 and compliance_requirements "SOC 2, GDPR".

The draft gave a commander ("the COO or a designated crisis lead"), a core team, two playbooks and message rules. The draft's line for affected customers names four parts: what was exposed, for how long, what you have done, what they should do. My suggested test is to hold any customer note to those four. A draft listing them proves nothing, so read each note yourself.

The commander starts from company size, so for an account takeover ask whether your CISO or CTO should hold the seat. The crisis types you pick change the draft: add data_breach and the customer wording loses "for how long". So check the four parts in every draft.

Three gaps matter for renewals. The draft has no line for unaffected customers who are asking. Its list of people to tell first omits your largest renewals. It names neither your cyber insurer nor outside counsel, so read the policy now: it can set notice terms and approved firms. SOC 2 is an audit report, so read the regulator line as a prompt for counsel.

Step 2. Make the call, then send the written account

Keep three conversations apart: the incident call from the account owner, the written account, and much later the renewal talk. Order the calls by harm and by what the customer must do now, with every affected account in the same window. Renewal date plays no part in that order.

A reviewer will ask the four parts, as alongside for Retool's post. My suggested rule: any part you cannot answer goes in as an open item with a date. If you cannot date the answer, date the next update.

Split the written account in two. The interim note goes out fast, with open items; the final report follows when forensics ends. Agree the rhythm early. An illustrative cadence: hourly while an attack runs, daily until scope is firm, weekly until the final report.

My suggested template, illustrative and not anything Retool sent: "On [date] an attacker reached [system]. Based on our investigation as of [date], your account was [affected or not affected]: [what changed], between [start] and [end]. We have [steps taken]. Please [action] by [date]. We do not yet know [open item]. [Name] is your contact, and our next update comes by [date]." If a scope line proves wrong, correct it the same day to everyone who received it, and say what changed.

What to copy from Retool: telling readers who were not notified that "your account was not impacted". Write yours only once security and counsel confirm it. And whoever is right about a supplier, put your own part first, with an action the customer can take this week.

Hand-off: join exposure to contract dates and baseline the list with Account health check, 5 to 15 accounts a run.

Step 3. Sort the list by notice date, then assess each account

Input to the Renewal save plan skill, all illustrative: a CS manager's note on day 20 after an incident, with the three invented accounts and factor scores alongside. They are not based on any real Retool customer, and the wait for A's final report is the exercise, not anything Retool did.

Sort by what is due. Notice dates are 13, 29 and 105 days away; renewal dates alone hide how close A and B are. A comes first, then B, the largest contract, then C on its own clock: the Champion Departure Save sets a new relationship within 30 days of a departure.

The skill lists ten factors and five bands but no weights, so the points are my suggested hand scoring, scaled to 100, leaving out what the paste did not state. Its sum: $354,000 renewal ARR, with $144,000 (41%) at risk, meaning Uncertain or below.

Do not plan on that 41%. One raw point on A (54 of 90, so 60, Likely) takes it to $48,000 (14%). An engaged sponsor at C as well (49 of 80, so 61) takes it to nil. And B, 59% of the ARR, sits outside it. Use the score to gather facts, then set each status by hand.

My suggested override: the score has no row for an incident, so any account with an open security review goes on watch, whatever its band. That puts B, at 77, beside A, because its new CISO may be able to stop the renewal. B's "If I'm Wrong" test sets the next step: if the questions are "the start of a formal replacement review", it becomes a Competitive Displacement Save, so ask the CTO within 48 hours what prompted them. And not notified is not the same as not affected: write nothing firmer until the incident lead confirms it.

The skill has five save types and none is an incident. A took Competitive Displacement, but self-hosting may mean your own product on their infrastructure, which keeps the account. Ask the Head of Security: "self-hosting what?" If so, the work is a deployment plan, and only the in-house build is competitive.

The notice date will not wait for forensics. Get a committed date for A's report today. If it cannot land in time, Legal and the VP of CS decide whether to "offer a written extension of the notice date". Hold the renewal talk until the written account is out, using the interim note if the final report is late. If a customer raises renewal or exit first, answer plainly and bring in counsel.

On offers, a controls question takes other answers than a discount: a short bridge extension, a written security commitment, or an exit right tied to a named control. Service credits in the contract are owed, not offered.

The hard case is missing from this table: a customer that may have lost money. If one reports a loss, the renewal plan stops. Counsel and your insurer own the contact, and nobody discusses cause or fault without clearance.

C is why the whole list gets checked: its risk has nothing to do with the incident. That is an example on invented accounts, not a finding. The skill takes up to five accounts a run.

This is the point where I would want a second pair of eyes: incident exposure meets a renewal notice deadline. Bring me your counsel-reviewed written account, exposure and contract dates, and we will work it through in 45 minutes.

Cloudflare, November 2023 to February 2024

What happened: Cloudflare detected a threat actor on a self-hosted server on 23 November 2023 and published its account on 1 February 2024, the day after its outside investigation finished. What it said: "no Cloudflare customer data or systems were impacted", and, of credentials leaked in the October 2023 Okta compromise, "we failed to rotate one service token and three service accounts".

What to copy: one dated scope line account teams can repeat word for word, and, once counsel and your insurer have read it, your own miss stated in your own words.

CrowdStrike, July 2024

What happened: a content update on 19 July 2024 crashed Windows hosts. What it said: the same day its CEO wrote "I want to sincerely apologize" and "This was not a cyberattack". Its root cause analysis on 6 August gives customers control: they "can choose where and when" these updates deploy.

What to copy: turn the fix into a control the customer holds, so procurement has something to check. And cost any goodwill package first: its packages included discounts, extra modules, services and longer terms.

Brex and Silicon Valley Bank, March 2023

What happened: the crisis belonged to someone else. Brex's customers with funds at Silicon Valley Bank faced payroll. What it said, company-reported: on 10 March 2023 it offered an emergency bridge credit line. When the Federal Reserve said customers had access to their funds, Brex closed it: "no longer a gap to help cover".

What to copy: when a crisis hits your customer and not you, find their next bill and speak to that. Close the offer in public when the need ends.

Atlassian, 2023 to 2024

What happened: three critical Confluence Data Center and Server advisories from October 2023 to January 2024. What it said: its policy is to post a critical advisory "at the same time as releasing a fix", as on 4 October, which names the fixed versions and says "Atlassian Cloud sites are not affected". On 6 November it raised the 31 October rating from 9.1 to 10 and reported exploits and ransomware.

What to copy: tell each deployment in one line whether it is affected and the exact action, and raise the rating in public when the facts change.

Linear, January 2024

What happened: on 24 January 2024 a database migration "accidentally deleted data from production servers". What it said: within six days a post gave the cause, the scope (12% of workspaces had data unavailable until restored) and the result (over 99% restored within 36 hours). Administrators got an email and a recovery page; no email meant no data lost.

What to copy: let each admin see their own position, and tell everyone else how to know they are not affected.

CTS, November to December 2023

What happened: CTS, an IT provider to UK law firms, said an outage "was caused by a cyber-incident". Ransomware is press reporting, not its statement. What it said: on 21 December it set a target, "more than 90% of impacted clients" operational or in final testing by the end of that week. Its marketing director later gave Today's Conveyancer 97% (company-reported). CTS then confirmed "all CTS managed systems were restored by 22 December".

The limits: the target came a day before its end date, about four weeks after the first statement, and the article does not define final testing. On 5 April 2024 The Business Desk reported administrators appointed to three companies running the group's managed IT arm, with all 140 jobs saved. The part open to read gives no cause; none is claimed here.

What to copy: a public target with a date, then the result against it. Set yours earlier, and define the measure.

1. Opening the renewal talk before the customer has the written account.
2. Working to the renewal date when the notice date falls first.
3. Letting each team describe the scope in its own words.
4. Stopping updates when the systems are back, with customers still asking.

• When High Adoption Hides Churn Risk: A GUARD Health Check, Save Plan, Expansion Case and QBR on One Book of Accounts
• How I Stress-Test an Annual B2B GTM Plan Before the Board Sees It, With a Pre-Mortem and a Bottom-Up Count
• All 24 guides