What breaksFragmentation · Interoperability Failure · Resource Orchestration Failure · Context loss
SCN-005Coordination breakdown
During the Cyberattack, Six Teams Work in Six Different Realities.
The technical incident is only half the crisis; the other half is keeping security, operations, leadership, communications and partners synchronized.
ScaleNetwork
UrgencyImmediate
Coordination gapExtreme
StakesEssential service · Money · Privacy
FragmentationInteroperability FailureResource Orchestration FailureContext loss
What Koali changes
← Back to the full MosaicKoali holds the incident as a governed timeline: facts versus hypotheses, affected services, owners, containment decisions, dependencies, external requests, communications and recovery gates. The post-incident record is produced by the response itself.
Who holds part of the picture
security • IT • operations
Koali response
Koali holds the incident as a governed timeline: facts versus hypotheses, affected services, owners, containment decisions, dependencies, external requests, communications and recovery gates. The post-incident record is produced by the response itself.
Real-world parallels
- Change Healthcare cyberattack — U.S. HHS
- 2020 Nova Scotia mass casualty — Mass Casualty Commission
What success looks like
The relevant state remains visible across handoffs and time. • Responsibilities, unresolved questions and escalation paths are explicit.
Documented parallels show that the failure mechanism is real; they do not claim Koali would have changed a specific outcome.
During the Cyberattack, Six Teams Work in Six Different Realities.
The technical incident is only half the crisis; the other half is keeping security, operations, leadership, communications and partners synchronized.
The problem
Security sees indicators of compromise; IT sees broken systems; operations sees unavailable services; legal sees obligations; communications sees public risk; executives need choices. If those streams separate, decisions lag or contradict one another.
What breaks
- Fragmentation
- Interoperability Failure
- Resource Orchestration Failure
- Context Loss
Who holds part of the picture
- security
- IT
- operations
- leadership
With Koali
Koali holds the incident as a governed timeline: facts versus hypotheses, affected services, owners, containment decisions, dependencies, external requests, communications and recovery gates. The post-incident record is produced by the response itself.
Human authority
Authorized humans and institutions retain their existing legal, professional and democratic authority. Koali structures knowledge, coordination and traceability; it does not take sovereign or professional decisions.
What success looks like
- The relevant state remains visible across handoffs and time.
- Responsibilities, unresolved questions and escalation paths are explicit.
- The outcome produces reusable memory for the next comparable case.
Real-world parallels
Change Healthcare Cybersecurity Incident — U.S. HHS
HHS described the 2024 cyberattack as having unprecedented nationwide impact on patients and health-care providers.
Relation to scenario: DIRECT
Source: https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html
Turning the Tide Together — Mass Casualty Commission, Volume 5
The Commission documented critical-incident communication, public-warning and inter-agency coordination failures during the 2020 Nova Scotia mass casualty.
Relation to scenario: STRONG ANALOGUE
Source: https://masscasualtycommission.ca/files/documents/Turning-the-Tide-Together-Volume-5-Policing.pdf
Boundary
The documented cases illustrate analogous failure mechanisms. They do not establish that Koali would have prevented the event or guaranteed a different outcome.
Koali loop
signals → shared meaning → evidence → choice → responsibility → action → verification → memory → better knowledge