## 4 Results
### Communication Strategies and Restoration of Corporate Image  
The review of communication strategies revealed deficiencies in transparency and speed of response. Although some organisations implemented internal communication channels to mitigate the impact, external communication proved insufficient to counteract the deterioration of the corporate image (see Table 9). The lack of established protocols for crisis management complicated the restoration of customer and partner confidence.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Type of Attack** & **Incidence** & **Technical Response of Employees** \\ \hline \multirow{4}{*}{Ransomware} & 54\% (108 companies) reported & Regarding risk response plans, 67\% (134 companies) stated that they had implemented containment protocols (PR.1) and had formal procedures for disconnecting compromised devices (DC.3). However, only 45\% (90 companies) had a data backup and recovery plan in place (PR.2). \\ \multirow{4}{*}{Phishing} & Meanwhile, 32\% (64 companies) faced phishing incidents (TA.2) that resulted in credential theft and potential data leakage & They configured security technologies for email; also, authentication technologies were implemented that verified the origin of messages and rejected forged messages. \\ \multirow{4}{*}{Data exfiltration} & 14\% (28 companies) suffered data exfiltration (TA.3) directly through vulnerabilities in their systems or unauthorised access & Risk response and disaster recovery plans supported by international standards and norms were activated In addition, 58\% (116 companies) indicated having an active SOC (DC.4) that monitors threats and coordinates the response, while the remaining 42\% (84 companies) depend on external services or react ad hoc to incidents. \\ \hline \end{tabular}
\end{table}
Table 7: Main attacks, incidences, and technical responses.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt}} \hline
**The Type of Company** & **The Impact on Work Teams** \\ \hline \multirow{4}{*}{Companies in the banking, health, retail, and services sectors mainly} & 75\% (150 companies) reported an increase in the workload (EP.1) of IT teams during the incident, reflecting a constant demand for overtime and the need to make critical decisions under pressure. Likewise, 60\% (120 companies) highlighted frustration (DE.1) and loss of confidence in security measures (DE.4) as the main emotional and psychological effects on employees. \\ \multirow{4}{*}{Companies in the logistics, government, manufacturing and technology sectors} & In terms of remediation and service restoration, 70\% (140 companies) indicated that coordination with external providers (RS.2) was essential to recover operability, while only 30\% (60 companies) acknowledged having communication problems and slowness in identifying affected data (RS.3). \\ \hline \end{tabular}
\end{table}
Table 8: Reported impacts on work teams by type of company sector.  
Regarding transparency, 45% (90 companies) decided on public acknowledgment of the incident (TR.1), while 55% (110 companies) preferred to handle the situation internally, revealing few details to avoid further erosion of the corporate image. This duality of approaches is directly related to reputational risk management and the organisation's culture in the face of cybersecurity crises [43]. These findings suggest that, in the Colombian context, the combination of technical weaknesses and inadequate crisis management exacerbates the reputational impact on both the organisation and its employees.