How do you plan for every threat?
The short answer
Plan for the losses a threat causes. Nearly every threat lands as one of five losses: a site, a system, a supplier, people or data. Prepare workarounds and recovery for each loss on your critical services, and you cover most threats, including the ones nobody has named yet.
The threat list never ends
Open any risk register and count the threats: ransomware, data center fire, flood, pandemic, cloud outage, supplier insolvency, strike, sabotage, solar storm. Each one gets its own scenario, its own plan and its own review. The list grows every year, and the team preparing for it stays the same size.
You can't plan for every threat. You can plan for what they do to you.
Nearly every threat lands as one of five losses
Whatever the cause, a disruption takes something away. In practice it is almost always one of five things:
Plan against these five and the work becomes finite. A threat nobody has named yet still lands in one of the rows.
Real threats combine losses
Most serious incidents hit more than one row. Ransomware is a system and a data loss, and often a people loss too, when staff can't work. A cloud region outage is a system and a supplier loss. A regional flood takes a site, people and often a supplier at once. A grid operator that cuts its control center off from IT as a precaution has chosen a system loss to prevent a bigger one.
Plan each loss once, for your critical services. Then combine them into scenarios. The plans for each row get reused instead of rewritten per threat.
Build severe but plausible scenarios
Regulators in financial services expect firms to test against severe but plausible scenarios. The five losses give you a structured way to build them: take the losses that hurt your critical services most, combine them, and stretch the duration.
For example: the primary data center is unavailable for three days, and the backup site depends on a provider that is affected by the same regional event. That scenario combines a site, a system and a supplier loss, and it tells you more than a generic "data center outage" ever will.
Check your coverage
With five losses and a list of critical services, coverage becomes a simple grid: one row per service, one column per loss. Each cell answers three questions. Is there a workaround or recovery path? Has it been tested? When?
Empty cells on high-impact services are your gaps. They go straight into the investment conversation. *\[Link: How do you prioritize resilience investment?\]* The weakest cell is also a good choice for your next exercise.
A practical way to begin
- List your critical services.
- For each one, write down what happens if each of the five losses hits it.
- Mark where a workaround or recovery path exists, and when it was last tested.
- Combine losses into two or three severe but plausible scenarios for your organization.
- Exercise the scenario with the weakest coverage first.
How we do this in resimate
In resimate, loss scenarios run against your real dependencies, so the blast radius, the recovery sequence and the gaps come from your own data. Every capability improvement gets recorded with an owner, so you can track what each scenario still needs. Teams go live in 4 to 6 weeks, on the data they already have.