If your business lost several systems at once, would the recovery order reflect what your customers need most?
In this episode of Tech Talks Daily, I speak with Mike Campbell, CEO of Fusion Risk Management, about operational resilience and the connections that can turn one disruption into a wider business problem. We discuss why application recovery, supplier continuity, employee knowledge and customer service need to be understood together when leaders decide what to restore first.
Mike shares an example involving an unnamed retailer whose existing IT recovery plans followed a logical technical sequence. During a demonstration using those plans, he says the business identified a different priority: restoring its online presence before concentrating resources on stores that had some manual alternatives. The lesson is about the assumptions inside the plan. This was a planning example, rather than evidence of a measured recovery during an actual outage.
What interested me was the distance between knowing which applications sit on a server and knowing which business activities depend on them. That connection affects how teams judge financial impact, customer consequences and the order in which work should happen. It also explains why operational resilience is a boardroom discussion, with choices about suppliers, investment and acceptable disruption sitting alongside technical decisions.
We consider the role of simulation and testing across different scenarios. Mike describes how Fusion's platform can help teams compare variations and identify recurring weaknesses. Those findings depend on the information and assumptions behind the model, and the conversation doesn't establish that a simulation can guarantee what will happen in a real incident. It does offer a useful way to question whether a single rehearsal has covered enough possibilities.
There is also a very practical communications example. If the usual email service becomes unavailable, teams need a way to coordinate that doesn't depend on the same failed services. Mike argues that deciding this while normal communications still work is much easier than trying to assemble an alternative during disruption.
Finally, we discuss people as potential single points of failure and the decisions involved in relying on one supplier. Resilience becomes something leaders consider when designing the business, supported by testing and an understanding of the consequences of different choices. Please share your thoughts with me. Which dependency would you examine first to find out whether your recovery plan matches the business your customers rely on?
[00:00:00] Once a year, I open up a handful of places for people who are serious about launching their own podcast, but have never actually gotten around to it. And over the last 11 years, I've helped entrepreneurs, business leaders and Fortune 500 companies all launch their own shows. And here is how it works. You record your conversation on Zoom, Teams or whatever works best for you.
[00:00:23] You send me the audio, an episode title and short description, and I will handle everything else from setting up the podcast host and distribution to getting your show on Apple Podcasts, Spotify and the many, many other podcast platforms out there. I will commit to working alongside you to help you launch your first season of 12 episodes in the bag. So you can start 2027 by ticking a season of podcasts off your bucket list.
[00:00:52] Think of me as your not just personal podcast producer, but also your accountability partner to make sure that you actually deliver those 12 episodes into podcast land. Now, I only offer this once a year with limited places available. So if you want 2027 to be the year you finally launch that podcast, head over to techtalksnetwork.com. Send me a message, send me a DM or even an audio message. I'd love to help you make it happen.
[00:01:22] If several systems all failed at once, would your business know which one to bring back first? The technical recovery order might look perfectly logical, but it could still leave the service that your customers depend on all waiting at the back of the queue. Well, today here on Tech Talks Daily, I'm joined by Mike Campbell. He's the CEO of Fusion Risk Management.
[00:01:47] We're going to discuss what operational resilience actually means when people, applications, suppliers and revenue all depend on one another. And Mike will also bring this to life by sharing a retailer example that challenged the existing recovery plan alongside a surprisingly familiar problem. How do you coordinate a response when all your usual communication tools are unavailable?
[00:02:14] And we will also discuss testing different scenarios, weighing the cost of resilience against consequences of disruption. So what I'm trying to say is if your recovery plan looks reassuring on paper, today's conversation will offer some useful questions to ask before you actually need it. But enough from me. Let me introduce you to Mike right now. Thank you for joining me on the show today. Can you tell everyone listening a little about who you are and what you do?
[00:02:44] Certainly. I'm Mike Campbell. I'm the CEO here at Fusion Risk Management. And Fusion is in the business of delivering a platform for resilience. And simply put, that platform allows you to understand how your business works, the interdependencies, the connectivity, the flow, and then monitors any of those elements for any kind of disruption. And if something bad happens someplace, we can tell you right away, here's what's happening. Here's how it's going to cascade through your operations.
[00:03:12] And ultimately, here's what the business reputational, employee, customer impact is going to be. And therefore, we can help you build the best possible recovery plan or risk mitigation plan in the moment. And you and I are both of a certain age where we've seen every organization having everything on-prem. Then the cloud came along and everyone started moving things to the cloud. Resilience has meant many different things over the years.
[00:03:38] And of course, now we're throwing in AI and, well, most importantly, hundreds if not thousands of AI agents. So I'm curious, how has responsibility for operational resilience, how's that moved from IT and compliance teams and maybe now into the boardroom? It absolutely is moving into the boardroom and in the C-suite just because of the magnitude and the variety of the attacks that are coming.
[00:04:03] And it is no longer just a hurricane or a typhoon or an earthquake or even a cyber attack. You're starting to see all kinds of state actors, for example, where people are targeted. Redundant data centers are taken out with drones. I mean, it's a very different, dangerous and dynamic world that we're living in. The thought had been for a number of years, let's do business continuity by business line or by this building or right.
[00:04:31] So you get pockets of resilience, but nobody has the holistic view of the business. And frankly speaking, they're all completely interconnected. As soon as you artificially or arbitrarily cordon off a piece, you, by definition, can only be partially resilient. So the one you're talking about is one that has taken a lot of the lead over the last few years
[00:04:55] just because a lot, if not most, of the incidents that impact your business now are cyber-related. Right.
[00:05:32] So the one you're talking about is one that has taken a lot of the things that you're doing. That's a lot of the things that you're doing. That they actually don't even know. Here are the five applications on this server that's just been impacted. I have no idea what lines of business those five applications are supporting. Therefore, I can't tell you which one I should bring back first because I don't know what the, what's got the biggest financial impact to the business. When you look at it holistically, you understand immediately, these are the critical things you're doing.
[00:05:58] And these are the ones that you need to bring back first to minimize the damage to your customers, to the environment, to the economy. Right. And those are the kinds of things that people are asking for at the C-suite now too. How is our ability to respond crucial to not just our P&L, but to society? So many great points there. And I think there'll be a lot of leaders listening, thinking they've got a resilience plan in place. But then, of course, I think it was Mike Tyson once said, everyone has a plan until you're
[00:06:28] punched in the face. And when those P1 incidents hit, when the board keep coming and interrupting the tech team, saying we want a regular update every 15 minutes on what's happening, it's a very different atmosphere then. So it'd be great if you could share maybe an example of an organization that had a convincing recovery plan on paper. But then discovered that its real recovery capability was something a little different. You'd have to mention any names, but do you have any examples like that? I cannot mention names.
[00:06:57] So I'll give you one that was just mind-blowing because it was just so foundational. Very large retailer. And we were looking at a specific aspect of resilience because we were talking to the IT folks. And it was a set of IT recovery plans. How do you better build your systems back up to make sure that you are, again, minimizing the damage? And we were able to take the existing recovery plans that they had, and they were all built very logically.
[00:07:26] The mindset here is you get the bare metal, you get the operating system in, you get the application, oversimplifying, of course. Then you repatriate the data after you're sure that there are no elements of malware hiding in the data. So it's more a procedural set of precedents. What they hadn't done is, again, connect what those technical elements supported in the business. And this was part of a demo. This was this simple. And this is why this is so amazing.
[00:07:57] We immediately ingested their existing runbooks. And our system came back with very little information that we were able to put in because it wasn't configured. It was just publicly available data. And our system said, you have to put all available resources on bringing your online presence back. The stores can fend for themselves. And it never occurred to them. But you look just a step beyond that. And you will, of course. That's a zero-one decision.
[00:08:23] You're either up and running online and generating the bulk of the revenues of the business, or you're down and you're getting zero. Stores have ways to gradually come back, manual processes, people that they can put on things. But if you don't get the online presence back, you're at zero. So again, in hindsight, you don't need a system to tell you that. It's just allowing you to look at it in a better, more holistic way. So that was the biggest disconnect. They immediately changed that process, of course.
[00:08:54] And for people listening, especially leaders, how should they be better maybe measuring that gap between those documented procedures that they have and what the business can actually recover during a real live outage? The real answer is it should be more jarring to the people on the board in the C-suite because you can't. Most of these folks are doing a tabletop exercise, which is one single scenario. It takes forever to set it up. It doesn't have a whole lot of nuance.
[00:09:23] You're not doing variations on a theme. And you're really doing it to test the people, get them a little more comfortable. Are they going to be able to operate in these kinds of environment? Now, you do find gaps when you do that, which is part of the benefit. But what our system will allow you to do is run thousands of different scenarios, a hundred variations on each, and it will catalog where you have discrepancies, where you have common vulnerabilities to allow you to see and value what those vulnerabilities are.
[00:09:53] So now you can say, here's why we're going to take care of these vulnerabilities because they hit 60% of our scenarios. Those go down. So now you know, if you can do this kind of simulation, if you can do this kind of testing, then you're able to quantify where are we most at risk, where is the highest impact, and what are we willing to spend to mitigate those risks. Without being able to do that kind of simulation, you're guessing.
[00:10:22] And another big important word that many leaders are focusing on is compliance. But I was reading how some compliance-led approaches, if too heavily focused on just compliance alone, often miss the operational risks that cause the greatest business damage. Is this something you're seeing as well? That has traditionally been this market. You're doing a business continuity plan or even a recovery plan for the wrong audience. You do it for the compliance people who are going to give you the checkmark.
[00:10:51] You're doing it for the auditors because they insist, or the people on the risk committee. Here's the 800-page binder. By golly, we've given it a lot of thought. But when the very thing that happens, that that 800-page binder was written for, when it happens, nobody calls them. Nobody asks for the binder. It's written for a different audience. So what ends up happening is, because nothing ever goes down the way a single static plan anticipates it, right?
[00:11:17] Or these days, it's never the one singular event. They cascade. And in fact, sometimes by design, wait for a natural disaster to hit a company, then hit them with a cyber attack. Those kinds of tactics are becoming more and more prevalent. The combinations are too much for you to plan statically to prepare for. There are just an infinite number of ways that these things can manifest themselves.
[00:11:42] So that's why you have to look at it systemically and understand the connections and then layer these impacts. You know, as something new happens, what's been impacted? How badly is it operating? And how does that cascade through my ability to keep running my business? As soon as you have that ability, you have the ability to understand the impact, to better validate what needs to be done next, and what order to do it in to minimize the damage and bring the systems back up in the most appropriate way, the optimal way.
[00:12:13] And for leaders listening, whether they get their nightly news from the TV or online or doom scrolling, one common theme that we're seeing on both sides of the pond at the moment is a lot of news around cyber threats and outages, for example. So what questions should boards be asking CEOs before the next major disruption rather than after it? What kind of questions should they be asking? Because I think it's very top of mind right now, and quite rightly so. Well, there are a number of scenarios that are happening on a regular basis.
[00:12:43] Data redundancy, for example. When Iran took out three redundant data centers, that was a carefully crafted plan to send a message, right? So how are our data centers set up? How resilient are they? What are we doing to take care of this kind of environment? Anytime you see something that could readily apply to you, ask the question. But I will warn you that there are a lot of things going on, and just because you understand that they could happen doesn't mean that you know how your systems will respond.
[00:13:12] If you don't have a plan, even if you do have a plan, you don't know, you can't test right now without a platform, you can't test to see if that resilience capability is truly there, and it's been worked out with variations on a theme covered. And I think when it comes to resilience and cybersecurity, it can very often feel like you're having to spin so many different plates. So where do you often see leaders facing the hardest trade-offs between cost, speed,
[00:13:41] customer experience, and resilience? There's so much going on there at the same time, right? And that's the fundamental problem. They're blind. They're absolutely blind. How do you know what the trade-off is? You only are looking at one scenario. And with that, one layer of one scenario, how do you say that that's a trade-off? You have to look at it across a lot of different things that could hit you. Again, which things commonly break?
[00:14:07] You know, if I've got the same thing that breaks in, give you an example. We found that in a number of cases, cyber incidents, if they take down Outlook, that's the primary communication vehicle. It can take two to three days with Outlook being down and your ability to communicate dramatically impacted. Setting up a backup communication system can take days. Nothing happens on the planning because you haven't even talked to each other.
[00:14:36] That's a very common finding that we're seeing. And you can't just throw it to teams because they run on the same equipment. So just think it through. If you've got Outlook up and running, coming up with a backup communication plan is trivial. It's really hard when you can't communicate with anybody. So those are the kinds of things that we're seeing too. But it happens in a huge number of the scenarios that people are evaluating from a cyber perspective. So just know where those common failure points are and focus on those.
[00:15:06] But again, you need to be able to look at certainly hundreds of scenarios to get any kind of real feel for trade-off. And I'm curious, from everything you're seeing and hearing here, are there any trends in the kind of thing that are separating organizations that have materially improved resilience from those still maybe relying on old, outdated playbooks that were built for a very different era and certainly not an AI era? Yeah, it has changed pretty dramatically recently.
[00:15:35] For a long time, this whole set of industries, third-party risk, IT disaster recovery, business continuity, all the people who worked in those industries thought of themselves as commonly fighting the forces of chaos and anarchy. What we're starting to see now is the people who are really getting there are seeing this as a massive competitive advantage.
[00:15:56] There's one company, I've got to be a little careful on this one for obvious reasons, but they were able to continue operating in the Middle East when all the other U.S. suppliers of these capabilities shut down. And they earned trust with people whose trades couldn't be cleared because everyone shut down except this one company. And so the trades were still going through.
[00:16:22] That earned huge trust and the ability to say, no matter what happens, we're going to be there for you. We're going to be your infrastructure. They're winning business that they wouldn't have won before. Showing that you're resilient. And if somebody depends on you, and this happens a lot, if I'm depending on you and I know you've proven that you're more resilient than party B, C, and D, I'm going to use you as my primary supplier because I've lived through this. I know what happens when critical third parties shut down.
[00:16:52] If you've proven that you're really hard to shut down, that's a huge competitive advantage. Do you need AI agents that you can trust? Well, with an AI data layer providing real-time connection within your data platforms, you can trust your agents to provide accurate solutions. So scale your business by trusting your agentic AI accurately getting the work done for you. Trust its capabilities with Denodo.
[00:17:19] And you can do that by simply visiting denodo.com to learn more. And I think one of the things that is often missed when leadership teams are talking about plans, compliance, cost, speed, customer experience, and resilience, the big theme of today's show, is the human element. So when a disruption or attack hits, what are the human consequences for employees and customers that every technical recovery metric that we all know and love can actually end up overlooking?
[00:17:49] Well, that's a good one because there are a couple of aspects to the human in the loop. You need to know which people are critical for business processes. It's amazing how a server can take it down. So can a single person that doesn't have a backup. So knowing where those single points of failure are, really critical. Identifying them up front. Or teams, small teams that don't have a backup. Are they movable? Can the work that they're doing be placed in another location?
[00:18:19] But also the people who are going through these processes. Do they have the right understanding of what's happening? Are they able to ask and get answers to the most important questions? What's being impacted? How much is it going to hurt? What are my best steps to mitigate the damage or to recover from the damage? You have to have people who know how to operate in that kind of a crisis. And then let's take it one more step further.
[00:18:44] You have to have business leaders who understand that resilience is not something you tack on at the end. It's something that you build into the way you run your business, right? If you can do things with a single supplier and you get it cheaper, but the loss of that supplier can wipe out your ability to deliver products to end customers. Should you really be concentrating that kind of control in a single partner, in a single supplier?
[00:19:10] Or does it make sense to build a structure where you've got multiple suppliers for any critical element? It goes back to the design element of how you build resilience, not just how you slap it onto the way you're running your business today. And that's a big change as well. The ability to do these kinds of simulations makes that easier because you can try out new structures and say, does this actually make me more resilient? And if so, let's go that way.
[00:19:36] And listening to you today, I just know that resilience is so much more than just a word here. It's a huge part of your life and has been for some time. And I suspect that when you're scrolling down news feeds and you hear all these different opinions about resilience, you probably see a few myths, misconceptions or untruths. Is there any of those that we could lay to rest today? Any myths about resilience that you hear repeated? Yes. The one that drives us the craziest is resilience is a capability and an understanding.
[00:20:06] It is not a checklist for a regulator. It is not something that you just get the auditors to say, good enough. It's a way of running your business, a way of building your business and testing your business to make sure that you can continue operating no matter what comes your way and understand that and build that in and weigh the trade-offs, right? A hundred percent. And we are recording this. It's a very, very different mindset. Very different mindset. A hundred percent.
[00:20:33] And we are recording this at a magical time of year when many leaders will be starting to plan for next year what they should be doing and also looking at different solutions, et cetera. So what is your focus at Fusion Risk for the new year? And also for people listening who want to find out more information about anything we've talked about today, where can they go to keep up to speed with all the information and announcements coming out of there? Fusion Risk Management here in Chicago. We've got a LinkedIn page.
[00:21:02] We've got our own website, fusionrm.com. Come and visit us. We're constantly posting white papers. We have industry gatherings that are by region, that are by industry, that are by sophistication level. You can get with peers even before you become a customer. We'll bring you in and get you to start talking to some of the people who are doing this day in and day out so you understand where you are. In fact, we've got a mechanism now where you can come in and answer a few questions
[00:21:29] and we'll tell you where you stand on the resilience ability scale, which is always a good place to start, knowing where you are compared to your peers. If you're vastly behind, call us quickly. Oh, yeah. It was a perfect and powerful moment to end on. I've loved everything that you've brought up today and also busting a few myths along the way. And I would encourage everyone listening to check you guys out. I'll add the links that you mentioned there to the show notes. So for people listening, very easy. Just go down there and pop over and have a look.
[00:21:58] And any questions or feedback from people listening, I'd love to hear from you too. What does resilience mean to you? But more than anything, Mike, just thank you for bringing all this to life. Take care. The question I'd carry from this conversation today is whether your recovery plan reflects how your business is actually working. Restoring a server is useful, but knowing which customer service depends on it gives that work a purpose and a priority.
[00:22:25] And that same thinking applies to a supplier, a small team or the person everyone calls when something actually goes wrong. So a big thank you to Mike today. And you'll check out the show notes. I'll put links to everything along with all the other places that he recommended there. And one practical step, I think, is to check whether your backup communication plan depends on the same services as your primary one.
[00:22:50] That's one of the things I'll be taking away because finding that out during an outage could be an awkward time to start that group conversation. But please, share your thoughts. What would you test first to see whether your documented recovery plan matches the way that your business actually operates? Let me know. TechTalksNetwork.com But that's it for today. I'm out of time, so I'll be back again tomorrow with another guest. But thanks as always. Bye for now.