Stop trying to prevent every disaster

Last month I told MSPs to stop selling cybersecurity. Now I’m telling you to stop trying to prevent every disaster. At this rate, somebody may want to check on the Cyber Cowboy. Hear me out.

I’m not saying prevention doesn’t matter. Of course it does. Patch the systems, protect the identities. train the users and lock down the network. Put in the right security stack.

Do all of it. But eventually something is going to go wrong. A server is going to die. Someone is going to click something they shouldn’t.A vendor is going to have an outage. A storm is going to knock out power. Microsoft, your ISP, your phone provider or some SaaS company you’ve never met but somehow depend on every day is going to have a really bad Tuesday.

You can’t prevent every disaster. But you can decide whether your business, or your client’s business, is ready to survive one. There’s a big difference.

Prevention makes us feel safe

MSPs like prevention because prevention is comfortable. We know how to sell it.

• Firewall? Got it.
• EDR? Got it.
• MFA? Absolutely.
• Backups? Of course.

Add enough layers, and eventually that security diagram starts looking like something you need an engineering degree just to explain.

Again, I believe in all of it. The problem comes when we start believing all those layers mean nothing bad can happen. That’s not security. That’s hope with a monthly license fee.

I learned a long time ago, both in the military and in business, that the plan matters. But what matters more is what you do when the plan gets punched in the mouth. Because it will.

Left of boom gets the attention

Our industry spends most of its time talking about the left side of boom.

• What can we do before the incident?
• How do we stop ransomware?
• How do we block the attacker?
• How do we keep the system from failing?

Those are important questions. But I’ve become just as interested in the right side of boom.

• It happened. Now what?
• The ransomware made it through.
• The building lost power.
• The internet is gone.
• The server is dead.

The cloud application everyone depends on is offline.  Can the business still function? That question is a lot harder than “Do you have backups?”

A backup is not a business continuity plan

One of the biggest mistakes I think we make as MSPs is confusing technology recovery with business recovery. Those are not the same thing. You can have a perfectly good backup and still have a customer that cannot operate.

Congratulations, we restored the server.

• Can they answer the phone?
• Can they take payments?
• Can employees work?
• Can accounting make payroll?
• Can customers place orders?
• Can the business open tomorrow morning?

If the answer is no, we may have recovered the technology without actually recovering the customer. That’s why I’m such a believer in BCDR. The “BC” (business continuity) part matters just as much as the “DR” (disaster recovery). Maybe more.

Ask different questions

MSPs are technical people, so naturally we ask technical questions. What is the RPO, the RTO and where are the backups? What systems are critical?

Good questions. But sometimes we need to get out of the server room and ask the receptionist a question: What happens if the phones don’t work tomorrow?

Ask accounting: What do you absolutely have to have to run payroll?

Ask the owner: If this building disappeared tonight, what would stop you from doing business tomorrow?

Those answers may have nothing to do with a server, but that’s where you start finding the real dependencies: internet, phones, cloud applications, payment processors and a vendor. Or it might be one employee who has the only copy of some critical spreadsheet saved somewhere on their desktop.  We’ve all found that one.

Resilience is not just an IT problem

One of the lessons I’ve learned as NEXTGen has grown is that protecting a business is about a lot more than protecting computers. Technology touches everything now, and that means our job as MSPs has changed. We shouldn’t just be asking, “How do we keep this from breaking?” We need to follow up with, “What happens to the business when it does?”

That conversation changes things. It changes how you design backups, how you think about redundant internet, how you document systems and how you tabletop incidents. Most importantly, it changes the relationship between the MSP and the customer. Now you’re not just managing equipment, you’re helping protect the company’s ability to keep operating.

Where I’ve landed

I used to think the best disaster plan was the one that prevented the disaster, but I don’t anymore.  The best disaster plan is the one that assumes something eventually gets through because it will. Something will fail, somebody will make a mistake or some vendor outside your control will go down. That isn’t pessimism; it’s preparation.

My grandfather used to tell me a man is only as good as his word. If we tell a customer, “We’ve got you,” then I think that promise has to mean more than keeping the lights green on a dashboard. It means being there when the dashboard turns red. Prevent what you can, protect what matters, but spend just as much time thinking about what happens after everything goes sideways.

Anybody can look prepared before the storm. You find out how good the plan really is after the roof starts leaking.

Stop trying to prevent every disaster and start making sure your clients can survive one.

Related: Business preparedness: How MSPs handle disaster