Everyone has a disaster recovery plan—on paper

Everyone has a disaster recovery plan—on paper.

But when the lights go out, very few organisations have systems that actually work. Spain, Portugal, Oracle, Heathrow… these weren’t random outages. They were textbook examples of systems that failed exactly as they were designed.

At Merrill Lynch, I saw it firsthand. Twice. We ran full disaster recovery drills. Everything looked like a success—until we tried to use the restored systems. Nothing worked. Why? Because the one system that everything else relied on—Active Directory—was never restored.

So yes, my app was “restored” successfully. But without authentication, it was useless.

This is the cost of pretending you’re resilient: you run the drills, tick the boxes, declare victory… and miss the critical dependencies that actually matter.

If you’ve never validated that your system works end to end, under real pressure, then you’re not resilient. You’re wishful.

Real resilience doesn’t live in plans. It lives in pain.