Book III · The Shadow System · How To · No. 31
Fortify the Enterprise
For when the human element is your strongest layer of defence, not your weakest.
Corporate resilience is not a technology purchase — it's people, process and partners working from the same playbook.
A finance assistant gets an email from someone who signs off exactly like the CFO always does. The tone is right. The urgency is right. The only thing wrong is that the CFO didn't send it. Somewhere in a training video months earlier, someone told this assistant to be careful — but caution isn't what saves the transfer. Recognition is.
Most companies still treat security as an IT department problem with a compliance layer bolted on. The organisations that actually survive an attack treat it differently: as a discipline that runs through every desk, every vendor contract, every crisis rehearsal, long before anything goes wrong.
The card sets out three practice areas. The human element trains people to recognise manipulation, not just avoid it. The tactical core builds and tests an incident response plan before it's needed, not during the breach. The extended perimeter holds suppliers and vendors to the same standard as the business itself. It's written for leaders and the teams they run, not just IT.
It comes from The Shadow System, the closing book of the trilogy, where the fuller argument about organisational resilience gets made at length. The card doesn't need the book to make sense — it stands on its own.
Print it for the team that owns your incident response plan, or send it to the leader who still thinks a firewall is where the job ends.
Every practice area on this card assumes a breach will eventually reach you. The harder question it leaves open: does your organisation actually rehearse for that day, or just insure against it?
Fortify the Enterprise
Corporate Resilience
The Human Element
- Train for the scenario, not the slogan. Move beyond generic awareness videos — regular, scenario-based sessions teach employees to spot mismatched URLs, false urgency and unusual tone before they click.
- Treat failure as a teaching moment. Run routine phishing simulations and use the outcomes to educate, not discipline — punishing a click teaches people to hide it, not to avoid it next time.
- Build a blame-free reporting culture. Make 'see something, say something' real: every suspicious link reported early is a breach prevented, and speaking up should never carry a cost.
The Tactical Core
- Build the response team before the breach. IT, legal, communications, operations and HR each have a role in a crisis — nobody should be learning theirs when the alarm sounds.
- Decide who speaks, before anyone needs to. Prepare transparent, pre-approved statements for employees, customers, regulators and media so a crisis doesn't also become a communications failure.
- Rehearse the whole lifecycle. Detection, containment, eradication, recovery and post-incident review — test the plan with tabletop exercises and live simulations, because an untested plan is an unproven one.
The Extended Perimeter
- Verify before you onboard. Require documentation of a vendor's security maturity — certifications, policies and incident response protocols — before granting them access to your systems.
- Make resilience a contractual obligation. Specify encryption, breach notification and continuous vulnerability assessment in every vendor contract; don't leave security as an assumption.
- Grant access on need, not convenience. Review vendor permissions regularly and revoke credentials the moment they're no longer required — a forgotten login is an open door.
Resilience isn't measured by the absence of incidents.
From The Shadow System · © Neil Catton · Filed under design and leadership
Read it alongside
Also from The Shadow System · No. 24Secure the Smart HomeFor the moment you realise nobody in the house has thought about the smart speaker's security since the day it went in the box.
Also from The Shadow System · No. 38The Citizen SoldierFor when defence stops being someone else's job.
Also from The Shadow System · No. 17Build Your Digital FortressFor when the passwords are set, the 2FA is on, and the risk hasn’t actually gone away.