Amba Zeggen: Practice breeds resilience

November 3, 2026

_{This column was originally written in Dutch. This is an English translation.}

By Amba Zeggen, Lead Risk Culture and Behaviour at Probability & Partners

I could picture it clearly: freezers with a puddle of water underneath, defrosted croquettes, soggy oven pizzas and frozen prawns that had seen better days. Reports of hacked refrigeration systems at supermarkets suddenly make cyber risk a tangible reality. Someone changes a temperature setting remotely. The shopkeeper is left to deal with the damage.

I don’t know whether the affected businesses had practised for such a scenario. But I can imagine the questions they would ask. Can we use nearby cold stores as a fallback? Can we deploy mobile freezers that aren’t connected to the mains? Do we have a temperature alarm that goes off (even) at night? Those who don’t practise don’t think ahead about how to remain resilient after the initial shock. That’s where the value of practising lies. You discover which solutions are feasible and what you need to organise today to make them work. A fallback option sounds reassuring – until it turns out that the whole region wants to make use of it.

It will not have escaped your notice: geopolitical risk has become business as usual, even for financial institutions. It features on board agendas and is addressed in risk reports and scenario analyses. But there is a world of difference between discussing a risk and absorbing a shock. The distance to that defrosted croquette is shorter than we think. We’re not dealing with a refrigeration system that might defrost, but with payment transactions, policy administration, pension payments and trading positions. What if services in these areas grind to a halt? A contingency plan is only convincing if the organisation can actually put it into practice.

Take a prolonged power cut, such as the one experienced by Spain and Portugal in April 2025. Add a failed mobile network to the drill scenario. The contingency plan stipulates that the board must be contacted and the crisis management team convened. Fine. But how? Simply having a list of telephone numbers does not mean you have an alternative communication channel. Has a meeting point been agreed? Who is authorised to make decisions if board members are unreachable? A satellite phone can help, provided someone knows how to use it and the provider’s dependencies have been assessed.

And who else is listed in the contact book? Just colleagues and suppliers? Do you know who to contact at the local authority or the emergency services region to coordinate emergency power or accessibility? What assistance is available, and what can you actually rely on? You’re probably not the only one looking for a generator. A crisis network also includes public sector organisations. You need to organise those contacts and expectations in advance.

The same applies to backups. The mere existence of a backup copy says little about your ability to recover. Has it been tested to ensure that critical data and systems can be restored? How long does that take? Is the data reliable? And will recovery still be possible if your regular IT partner is overwhelmed by requests from other clients?

Or take staff availability. Suppose reservists are called up. Will this result in critical roles being left unfilled? Have replacements been arranged, including the necessary authorisations, knowledge and access to systems? During an exercise, the replacement shown on the organisational chart sometimes turns out to be little more than a name on paper.

An important question is how to select meaningful exercises. Don’t start with the shock, but with the context. How is the world order shifting, what trends and themes are at play, and what measures are states employing: sanctions, levies, export restrictions, sabotage, cyber-attacks? Plausible shocks follow from this. You translate these into your own organisation via three transmission channels: financial markets, the real economy, and safety & security. Only when you know through which channel a shock will affect you will you know what to practise for. Which dependencies are affected? Which processes will subsequently come under pressure?

In this way, an abstract risk becomes a scenario you can practise for: a critical service provider goes offline for 48 hours, whilst markets fall and additional collateral must be provided. Can you still trade, make payments and take decisions when the flow of information is disrupted? It is precisely this convergence of events that exposes vulnerabilities.

This doesn’t mean the whole organisation has to go into crisis mode every month. Work with the board and supervisory board to select a few relevant scenarios and run them through in a meeting. Who does what, with what information and within what timeframe? Then let one assumption fall by the wayside. The supplier isn’t answering. The fallback location is inaccessible. The backup turns out to be unusable. The real value lies in the uncomfortable discoveries. Document them, assign responsibility and test whether improvements work. If you want to keep a cool head during a crisis, you need to practise before the ice starts to melt.