When Crises Collide: How Leaders Untangle Organizational Stressors

What Incubates Before Organizational Polycrisis

Crisis management standards recognize that crises don’t appear from nowhere. They incubate over time through accumulated vulnerabilities such as inadequate governance allowing gradual slippages in standards, unofficial workarounds becoming routine, flaws in supervision, and chronic resource constraints.

What polycrisis theory adds is this: When incubating conditions exist across multiple organizational systems simultaneously, they can become causally connected — producing outcomes far worse than any single vulnerability would create.

An organization might, for example, simultaneously experience:

• Technical vulnerabilities: aging infrastructure, accumulated technical debt, systems past their replacement dates
• Operational strain: overwhelmed teams, manual workarounds that should be automated, processes that depend on heroic individual effort
• Structural weaknesses: silos between functions that need to coordinate, fragmented accountability, communication pathways that don’t connect the right people
• Governance gaps: oversight fragmentation, misaligned committee responsibilities, risk appetite that doesn’t match actual risk exposure
• Cultural erosion: complacency from past survivals, growth prioritized over resilience, warnings normalized rather than addressed

When these vulnerabilities exist in isolation, each is manageable. The danger comes when these conditions become connected — for example, when technical vulnerabilities can’t be addressed because of operational strain. That’s when a single trigger can activate a cascade that overwhelms the organization’s capacity to respond.

Think of it like a forest fire. A dry forest is stressed. A lightning strike is a trigger. Either alone is manageable — forests survive droughts, and lightning often fizzles out. But combined, they can create a firestorm that behaves in extreme, unexpected ways.

That’s the difference between a crisis and a polycrisis.

Standard Crisis vs. Polycrisis: Entanglement

In an ordinary crisis, you have a problem with a cause — so if you fix the cause, you solve the problem. But in a polycrisis, problems cause each other. Fixing one doesn’t help — and might make things worse — because the problems are entangled.

The difference becomes clear when you compare ordinary crises to polycrisis directly:

Stress vs. Trigger: Anatomy of a Collapse

Here’s what makes organizational polycrisis both dangerous and potentially manageable: the distinction between stresses and triggers.

Think of high blood pressure. It accumulates silently for years — that’s stress. A sudden shock causes a heart attack — that’s a trigger. Doctors can’t predict the shock. But they can treat the blood pressure.

Organizations work the same way:

• Stresses are slow-moving vulnerabilities that accumulate over months or years: technical debt, cultural erosion, deferred investments, structural fragmentation, and overwhelmed teams. They erode organizational resilience gradually. They’re also observable — leaders can see them, audits document them.
• Triggers are fast-moving events that arrive in seconds or weeks: a security breach, a failed product launch, an unexpected resignation, a supplier collapse. Any of these might be survivable on its own. But triggers don’t operate alone. They interact with whatever stresses have been quietly accumulating — and that interaction is what produces a polycrisis.

The crucial insight: Triggers don’t create polycrisis; they activate it. The entangled vulnerabilities already exist. The trigger reveals their connection.

Triggers get all the attention. Organizations spend enormous energy preparing for trigger events — crisis response plans, communication protocols, and war rooms. But the organizations that withstand potential polycrisis are the ones that systematically address the slow-moving stresses before triggers arrive.

How Organizational Crises Get Tangled

If polycrisis requires incubating conditions across multiple systems, how do those conditions become connected? Our research identified 4 mechanisms that appear consistently across documented organizational catastrophes.

1. Silos Become Highways.

Organizational structures create conduits that allow problems to propagate from one system to another — or walls that prevent them from being seen.

Imagine a house where each room is sealed off — no doors, no hallways. The kitchen can’t tell the dining room that dinner is ready. The bedroom can’t warn anyone there’s a fire in the basement.

That’s what organizational silos do. At the credit reporting company, the security team and the IT team operated in this isolation. When a critical vulnerability alert arrived, IT didn’t know security’s priorities, and security didn’t know which systems IT was running. The structure itself became a transmission mechanism for crisis — the walls meant to organize the company became highways for failure to spread.

2. Success Masks Danger.

You’ve heard microphone feedback during a presentation: the microphone picks up sound from the speaker, amplifies it, the speaker plays it louder, the microphone picks that up, and within seconds, you have an unbearable screech. Feedback loops that normally maintain organizational stability can shift to become reinforcing cycles that accelerate toward catastrophe.

Organizations experience similar feedback loops — except they’re harder to hear.

At the credit reporting company, an internal audit identified over 8,500 unresolved software vulnerabilities and recommended improvements. Management committed to fixes. Two years later, when the breach occurred, most recommendations hadn’t been implemented. The audit had documented the problem; the documentation itself may have created the illusion that the problem was being managed.

A second loop connected growth strategy to security posture. The company completed 18 acquisitions in a decade. Each acquisition added integration complexity and created security gaps. Yet growth remained the priority. The loop reinforced itself: Complexity enabled breaches, but growth imperatives ensured complexity kept accumulating.

When past success creates future vulnerability, you’re in a reinforcing feedback loop. And you probably won’t see it until it’s too late.

3. Cutting Here Breaks Over There.

A family can’t afford to fix the leaking roof because they’re paying off the car repair. The leak damages the ceiling. Now they can’t fix the ceiling because they’re still paying for the car, and the water has damaged the electrical system. Each unfixed problem creates the next one.

Organizations accumulate a similar debt — resource decisions in one domain create cascading vulnerabilities across interconnected systems that compound, like financial debt.

At the credit reporting company, a critical system had been slated for replacement, but leadership prioritized other initiatives. The legacy system remained vulnerable. Manual processes persisted. Security improvements languished. A report by a financial index provider gave the company’s data security efforts a 0 rating out of 10. The rating remained unchanged 8 months later. Resources continued flowing to expansion rather than remediation.

Each resource decision created downstream consequences. And when the trigger finally came, there was no slack left in the system.

4. The Same Pressure Hits Everywhere.

Sometimes vulnerabilities accumulate across systems not because one caused another, but because they’re all exposed to the same stress.

A budget freeze doesn’t cascade from IT to operations to training — it hits all 3 at once. A leadership transition creates uncertainty across every function simultaneously. An acquisition creates integration challenges in technology, operations, culture, and governance at the same time.

When multiple systems weaken together, no one has capacity to compensate for problems anywhere else. And when the trigger arrives, everything fails at once — not through domino effects, but through simultaneous collapse.

Interrupting the Polycrisis Pattern With Leadership

Polycrisis isn’t destiny. Even after a trigger activates connected vulnerabilities, leaders can still interrupt the pattern.

For example, a global industrial company was hit by ransomware that encrypted 22,000 computers across 170 sites in 40 countries. The trigger was a single infected email from a trusted partner. The malware captured administrative credentials and took control of the entire IT infrastructure.

Polycrisis conditions were fully present. Technical systems went dark, leading immediately to operational disruption, then to financial systems freezing, and finally to communication channels going offline. Multiple organizational systems were failing simultaneously, tangled together, producing emergent harm.

But instead of collapse, leadership interrupted the pattern. They shut down the entire network immediately — accepting short-term pain to prevent further entanglement. They knew how to run plants manually, pulling old procedure manuals from filing cabinets and calling retired employees who remembered how to operate without computers. They refused to pay the ransom. And they were transparent, holding daily news conferences and webcasts to share what they knew and didn’t know.

The attack cost over $70 million. But production continued. The organization survived.

These 3 things made the difference:

1. They addressed stresses before the trigger. Good backup systems existed. Manual procedures were documented. Relationships with external partners were in place.
2. They acted systemically, not sequentially. Instead of trying to fix problems one at a time, they addressed the system — shutting down everything to prevent further entanglement.
3. Leadership operated collectively. No single executive tried to command the response. Teams with real authority collaborated across boundaries simultaneously. 

Is Your Organization Vulnerable to Polycrisis? 

Most organizations have vulnerabilities that have accumulated over time. Those conditions almost certainly exist across multiple systems. The real question is whether anyone sees the connections. Here are 5 diagnostic questions to ask:

1. Do you have significant incubating conditions in multiple organizational systems (technical, operational, structural, governance, cultural) — not just one area of concern?
2. Are these vulnerabilities connected? Does a problem in one area prevent you from addressing problems in another?
3. If a trigger event occurred, would the damage be contained — or would it cascade across systems in ways that multiply impact?
4. Have attempts to fix individual problems failed because they’re connected to problems elsewhere?
5. Does anyone in your organization see the full picture of how your vulnerabilities connect?

Having 3 or more concerning answers suggests organizational polycrisis vulnerability. Standard crisis playbooks won’t be enough. 

What Senior Executives Can Do About Organizational Polycrisis (Before, During & After)

Before Polycrisis: Address the Incubating Conditions

Because triggers are unpredictable but incubating conditions are observable, the strategic priority is addressing vulnerabilities before they become entangled:

Find the node. When you map incubating conditions across your organization, one vulnerability typically connects to several others. That’s your priority — not because it’s the most severe, but because addressing it reduces entanglement. At the credit reporting company, fragmented governance sat at the center of the network: It prevented accountability for security gaps, allowed resources to be diverted from system upgrades, and created the silos where warnings disappeared. Addressing governance wouldn’t have fixed everything — but it would have weakened the connections that turned a breach into a catastrophe.

Reserve firebreaks. If all your capacity is consumed by current operations, you have nothing left to contain spread when a trigger arrives. Organizations that survive polycrisis maintain reserves — not generic contingency resources, but specific capacity held back to prevent cascading. When the industrial company was hit with ransomware, they could afford to shut down their entire network because they had maintained manual procedures and backup relationships. They had firebreaks. The credit reporting company had audited its vulnerabilities, planned its fixes — and diverted resources to other priorities.

Install circuit breakers. Because polycrisis involves feedback loops — where addressing one problem worsens another — you need predetermined triggers that compel reassessment. Define them in advance: When does solving Problem A start amplifying Problem B? What signal tells us to stop, reassess, and coordinate before continuing? Without circuit breakers, speed becomes a liability.

Build coordination capacity before you need it. Cross-functional relationships, shared awareness, distributed decision-making capacity — these must exist before crisis. You can’t easily build them during an organizational polycrisis.

During Polycrisis: Match Response to Complexity 

Here’s what makes a polycrisis so difficult to manage: It contains different kinds of problems simultaneously, each requiring a fundamentally different response strategy.

Some parts of the crisis need immediate stabilizing action before you can understand what’s happening. Other parts need rapid experimentation with fast feedback loops. Still others need expert analysis before action.

The dangerous mistake is misclassification. Treating a complex, emergent problem as if it just needs better analysis leads to paralysis while the situation evolves past your understanding. Treating a chaotic situation as if you have time to experiment leads to collapse. And treating everything as chaotic — the most common error under pressure — centralizes authority precisely when you need distributed decision-making across multiple fronts.

To avoid these traps, you can apply the Cynefin framework, a decision-making model that helps leaders match their response to the specific nature of the threat:

• If standard procedures exist and have worked before: Apply them. Don’t overcomplicate.
• If expert analysis can determine the solution: Get the expertise, do the analysis, then act decisively.
• If outcomes are unpredictable and interconnected: Run small experiments, get rapid feedback, adapt continuously. Don’t wait for certainty.
• If the situation is collapsing and you must act now: Stabilize first, understand second. But as soon as you’ve created stability, shift authority back to those closest to the problems.

The industrial company got this right. In the immediate chaos, leadership made the centralized decision to shut everything down. But once they’d stopped the spread, they pushed authority outward — to plant managers who knew how to run operations manually, to teams who could rebuild systems in parallel. They didn’t try to command the recovery from the center. At the credit reporting company, the silos that had allowed vulnerabilities to accumulate also prevented coordinated response — no one had authority across the boundaries where the crisis was happening.

After Polycrisis: Capture the Transformation Window

Polycrisis disrupts institutional inertia. Practices that seemed impossible before the trigger — decision authorities that couldn’t be distributed, silos that couldn’t be bridged, investments that couldn’t be justified — may become feasible when the old assumptions have been shattered.

This is a transformation window. It won’t stay open. Leaders who recognize it can build new capabilities, institutionalize crisis-born innovations, and emerge stronger. Leaders who focus only on returning to normal will restore the same incubating conditions that created the catastrophe.

The question shifts from “How do we recover?” to “What can we build now that we couldn’t build before?”

Patterns, Once Recognized, Can Be Interrupted 

If you’re leading an organization, polycrisis isn’t a theoretical risk. The same interconnectedness that enables efficiency — integrated systems, cross-functional processes, shared infrastructure — also creates conditions where vulnerabilities across multiple systems can become catastrophically entangled.

The question isn’t whether you have incubating conditions. Every organization does. The question is whether you can see the connections — and whether you’re addressing them before a trigger arrives.

Traditional crisis management assumed crises had single causes, bounded impacts, and sequential solutions. Leaders who apply standard crisis playbooks to polycrisis will find themselves explaining how a perfect storm of factors led to catastrophe.

But there’s nothing perfect about these storms. They’re predictable patterns of interconnected vulnerability: incubating conditions across multiple systems, connected by structural weaknesses, reinforcing feedback loops, and resource constraint cascades. The conditions are visible before the trigger arrives. The mechanisms connecting them can be identified. The vulnerabilities can be addressed before they become catastrophic.

Leaders who understand organizational polycrisis — who can distinguish it from ordinary crisis, who can see how their vulnerabilities connect, who address those vulnerabilities before triggers arrive — give their organizations a fighting chance. Not because they can predict the future, but because they’ve addressed the conditions before they’re tested.

Ready to Take the Next Step?

Build the capacity to handle organizational polycrisis and lead through uncertainty at the senior level with high-impact executive leadership development tailored to your organization’s most urgent challenges. Partner with us to develop a research-driven roadmap that turns systemic uncertainty into a strategic advantage.