The plan is not the point. The rehearsal is.

Twenty incidents, and the same three surprises

Adam has led response through more than twenty live incidents and ransomware attacks. The technical detail differs every time. The surprises rarely do.

• The backups existed and the restore had never been timed end to end.
• The plan named people who had left, and a phone system that was down.
• The first four hours went on deciding who was allowed to decide.

None of those are technology failures. All three are found by rehearsing and by nothing else.

What the work is

Readiness assessment

What you would actually do, measured against what you would actually need. Recovery time, dependencies, decision rights, insurance position, and who you are legally required to tell and how quickly.

Playbooks

Short enough to use at two in the morning. Ransomware, business email compromise, third party breach, data loss. One page each at the front, detail behind it.

Tabletop exercises

Board level and technical variants, run separately, because the two groups fail in different ways. Facilitated hard enough to be uncomfortable and fair enough that nobody leaves defensive.

What you get

• A readiness report with the recovery time you can defend to an insurer.
• Playbooks your team will use rather than admire.
• An exercise report naming what broke, what to fix, and in what order.
• A retainer arrangement, if you want a number to call that already knows your environment.

The honest part

Readiness work does not stop an incident. It shortens one, and it takes the panic out of the first day, which is where most of the damage and nearly all of the reputational cost gets decided.