A finance assistant gets an email from someone who signs off exactly like the CFO always does. The tone is right. The urgency is right. The only thing wrong is that the CFO didn’t send it. Somewhere in a training video months earlier, someone told this assistant to be careful — but caution isn’t what saves the transfer. Recognition is.
Most companies still treat security as an IT department problem with a compliance layer bolted on. The organisations that actually survive an attack treat it differently: as a discipline that runs through every desk, every vendor contract, every crisis rehearsal, long before anything goes wrong.
The card sets out three practice areas. The human element trains people to recognise manipulation, not just avoid it. The tactical core builds and tests an incident response plan before it’s needed, not during the breach. The extended perimeter holds suppliers and vendors to the same standard as the business itself. It’s written for leaders and the teams they run, not just IT.
It comes from The Shadow System, the closing book of the trilogy, where the fuller argument about organisational resilience gets made at length. The card doesn’t need the book to make sense — it stands on its own.
Print it for the team that owns your incident response plan, or send it to the leader who still thinks a firewall is where the job ends.
Every practice area on this card assumes a breach will eventually reach you. The harder question it leaves open: does your organisation actually rehearse for that day, or just insure against it?
You’re reading The Next Evolution by Neil Catton, articles that explore the human world and the intersection of technology, they try and ask difficult questions - not to scare - but to inform. If someone forwarded this to you, you can subscribe free at neilcatton.substack.com.
Neil Catton is the author of The Next Evolution, The Cognitive Crucible and The Shadow System - available on Amazon, and writes at the intersection of technology, ethics, and human purpose.