Do Nothing Until the Risk Becomes Unbearable
At the bottom of my garden, there's a wall.
An old wall.
At least 150 years old... maybe 200.
I know it's there.
A few of the bricks are loose.
There's ivy growing over it.
And the lime mortar has turned to dust - in parts.
The ivy - once a danger ready to pull the wall down - has become a structural support.
I know this.
I have known this for years.
But there is no strategic advantage to the wall.
It's just a wall.
It's just a way of separating two properties.
It's a cost.
It's doing a good enough job.
But I know the inevitable conclusion - it will fall down. It will fail.
It may be this week.
It may be this winter.
Or the one after.
At some point - if I don't do anything - the wall will fall down.
But not today.
So I can spend my effort elsewhere.
My neighbour thought the same about his outhouse in the summer of 2019.
He understood his error a few months later in the depths of winter.
I helped take it down on the coldest day of that year - working in the dark in temperatures well below freezing.
The outhouse performed a chaotic collapse.
There was no time for careful planning. We had to take it down - immediately.
Everything is fine - until suddenly it's not.
What could have been a calmly scheduled effort became a crisis.
People new to IT ask me - "Why don't executives "invest" in new IT and cybersecurity systems?"
👆 - this is why.
The "investments" don't provide a strategic, competitive advantage.
But when systems fail, and cracks start appearing - problems compound quickly.
The risk is that you must work to a hacker or ransomware's timelines rather than a carefully planned project - based on your business priorities.
So it's about - doing nothing until that risk becomes unacceptable.
I must order lime mortar - with the usual lead time issues.
And - because of the conservation rules - the bricks will need to be reclaimed and cleaned.
And - because it will need a complete rebuild rather than just pointing - it will need skilled labour.
And - because it's lime mortar - it can only be done 7 months of the year...
The effort will be ten times harder - if I wait for it to collapse.
That wall is starting to feel like an unacceptable risk.
Maybe it's time to schedule some preventative maintenance.
Is it time for your executives to review the risks they currently accept in your IT systems?