A system outage hits your company. The customer-facing app goes dark. Six hours later, it's still down, and the team working to bring it back can't tell anyone when it will be fixed. Not a rough estimate, not a worst case. They honestly don't know. 

That situation is the one Curtis Simpson shared with a room of Canadian technology leaders at this year's CIO Association of Canada Peer Forum, and my colleague Jennifer Friesen wrote about it this week. 

Simpson is the chief strategy officer at Gambit Security and a former global CISO at Sysco and Armis. His argument is that the job changed, and response plans haven't kept up. 

Canadian CIOs spent a decade building programs to stop breaches. 

The call that defines a career now is the one where everything is down, customers are locked out, and the recovery plan on file turns out to be good on paper. 

Simpson's estimate is that 95% of organizations aren't testing recovery the whole way through. 

The backup works. The secondary system works. The connection to the backup data centre works. Everyone gets a passing grade, the spreadsheet looks clean, but when a real outage asks all those pieces to work together at once, things fall apart.  

Joseph Ruck, Gambit's head of field architecture, has a phrase for the gap between the plan on paper and the outage in practice, which you can find in the article. 

These plans aren't dishonest. People are busy, and nobody books an afternoon to sit with the deeply unfun question of whether the thing actually works when it matters.

I once worked at a small company where the entire executive team planned to take the same flight to our user conference. Nobody stopped to ask what would happen to the company if that plane went down. Sure, it’s a dark thought, and statistically unlikely, but planning for problems is inherently negative.

Splitting up across two flights is the kind of small, obvious precaution you never make time to think about until someone says it out loud. 

A recovery plan that hasn’t been tested fully is the same blind spot.

Simpson lays out four questions every technology leader should be able to answer about an outage, and most can't answer all four with tested numbers. 

Want the questions? You guessed it, read Jennifer's article.

Some light reading for when the systems are, against all odds, still up

Europe risks 'total irrelevance' without sovereign tech: Cohere chief
Cohere's Aidan Gomez has a blunt warning for any country that rents its AI from elsewhere. Anthropic helped him make his point when it pulled its top models out of foreign markets on a White House order. Of course, there’s no reason to believe the current administration could make rash decisions. 

One of Canada's top economists says Canada has a window now to rebuild its industrial base
Stéfane Marion explains why Canada has the cheapest energy in the G7 but the smallest manufacturing sector, and what just changed in Ottawa that has him optimistic for the first time in a decade. 

Q&A: Nuclear microreactors offer a solution for Canada's energy infrastructure weaknesses
A lead-cooled reactor that runs for five years without refuelling, aimed at data centres, mines, and remote bases. Nuclea Energy's CEO makes the case for the small, unglamorous reactors 

Canadians trust AI for everyday banking, not big decisions
TD's latest survey found Canadians are happy to let AI reset a password, and much less happy to let it near their retirement savings. The reasons they give for drawing that line will sound familiar to anyone deploying AI inside an organization.

Edmonton's global ranking reflects a startup ecosystem built for the long game
Edmonton placed third in North America for affordable talent, with software engineers earning roughly a third less than the regional average. With AI capital piling into expensive U.S. hubs, that gap is starting to look like a plan. Or as the software engineers in Edmonton say, “chi ching.”

Alberta Innovates backs shared infrastructure with $14 million
$14 million that pulled in nearly $48 million more, aimed at a problem most founders know well. The supports exist, but finding them takes months you don't have. Terry Rock explains what the province is trying to fix.

What Canadian health IT buyers want before they sign
A survey of 212 health IT leaders comes down to one question vendors have to answer before the conversation starts: Can you prove it? 

Companies have a plan. It's written down, it passed the audit, and having the plan ticks the box before people really dig into whether it will work. 

A plan you've never tested is a seatbelt you haven’t buckled. It feels like protection right up until the one moment you need it.

You don't have to be the CIO for this to resonate. Somewhere in what you own, there's a plan you've never run, and you probably already know which one it is. Maybe it’s time you give it a test.

Oh, and buckle your seatbelt when the pilot turns the light on. 

— David