No plan survives contact

Helmuth von Moltke: “No plan survives first contact with the enemy.” Mike Tyson: “Everybody has a plan until they get punched in the mouth.” A field marshal and a heavyweight, a century apart, agreeing on the one thing that survives every kind of fight: the plan doesn’t.

The trap is treating the plan as the goal. A plan is preparation, not a script. You write it so the team has thought about the hard parts before the pressure arrives, not so you can read from it while the building is on fire. The moment real conditions diverge from the assumptions you wrote down, the document starts to rot, because the crisis didn’t read it. The question was never “did the plan hold.” It’s “how well do you operate once the plan is gone.”

Build order before you fix. The instinct under pressure is to start fixing the thing in front of you. The better first move is to impose structure: who’s running this, who’s doing the work, who’s deciding, who’s writing things down, and where the information flows. A crisis with no structure is just noise getting louder. Order doesn’t solve the problem, but nothing else can until it’s there.

Stabilize before you solve. Stopping the bleeding and curing the patient are different jobs, and they happen in that order. The goal in the first hour is to keep things from getting worse, not to land the elegant permanent fix. The expensive mistakes are usually the rushed early moves: the irreversible action taken to feel productive, the cleanup that destroys the evidence you’ll want later. Buy yourself stable ground first, then solve from it.

Decide on incomplete information. You will never have the full picture in time, and waiting for certainty is itself a decision, usually the wrong one. The skill is making the best call you can on what you have, saying out loud how confident you are, and staying ready to change your mind when better information arrives. A decision that’s 80% right and on time beats a perfect one that comes an hour too late. (The irreversible calls get their own treatment in Running the incident you’re accountable for.)

You set the temperature. In a crisis the room calibrates off whoever’s in charge. If you’re visibly panicking, everyone spends half their attention managing your panic instead of the problem. If you’re steady, ask clear questions, and keep a normal voice, people do their jobs instead of watching you to decide how worried to be. Humor belongs here too, used with care. A dry joke at the right moment isn’t making light of the crisis; it tells the room there’s a version of this where everyone comes out the other side, and people work better when they believe that. Hope is a resource in a crisis, and a well-timed laugh is one of the cheapest ways to hand it around.

Rehearse. Tabletop, tabletop, tabletop. A well-rehearsed team is a successful team, so run the exercise, then run it again, then run it with your best person out sick, then have someone else run it with you out of the room entirely. If the team only holds when you’re in the chair, you’re the single point of failure, and you’d rather learn that in a drill than on the day. Get hands on real adversary behaviour, not just slideware: I’ve leaned on TryHackMe for years and push it on everyone I know. Know your enemy (cue Rage Against the Machine): learn to identify TTPs, learn how to block IOCs, and drill the skills you’ll need to survive the nightmare that could be on your doorstep. Plans are a guess about the fight; training is what lets you keep fighting once the guess turns out wrong.

None of this is an argument against planning. Plan hard, because the preparation is the map and the ruled-out options you fall back on when the script burns, and rehearsal is how that preparation becomes reflex. But plan for the fight, not for the plan. The thing worth being good at isn’t the document. It’s the few minutes after the punch lands, when the plan is gone and you’re still standing there, expected to decide.