Organisations do not fail incidents because they lack a plan.
They fail because decision‑making does not hold under pressure.
Incident response is commonly treated as a procedural problem.
Organisations invest in:
playbooks
runbooks
tooling
tabletop exercises
These are useful.
They are not sufficient.
The misconception
A playbook assumes that:
events can be anticipated
actions can be predefined
escalation paths will hold
This works in controlled conditions.
Incidents are not controlled conditions.
They are:
incomplete
ambiguous
time‑compressed
And often contradictory.
This is where playbooks begin to fail.
What actually happens during an incident
Incidents are not managed through execution alone.
They are shaped by:
interpretation
prioritisation
judgement
At every stage, someone is deciding:
Is this contained or expanding?
What matters most now?
What can be deferred?
What risk is acceptable?
These decisions are rarely explicit.
They are inferred, often under pressure.
Why playbooks fail in the moment
When incidents deviate from expectation, playbooks become:
incomplete
ambiguous
or irrelevant
At that point:
steps are dropped
actions are improvised
communication fragments
What determines the outcome is no longer:
whether a plan exists
but:
whether decisions remain coherent without it.
The real dependency
Effective incident response depends on:
clarity of ownership
confidence in judgement
alignment across functions
shared understanding of risk
Without these, even well‑designed processes fragment.
This becomes visible as:
delayed decisions
conflicting actions
over‑escalation or under‑reaction
reliance on specific individuals
These are not process failures.
They are leadership failures.
Why organisations optimise the wrong thing
It is easier to improve:
documentation
tooling
procedural coverage
than to define:
who decides
how decisions are made
what authority exists in ambiguity
As a result, organisations optimise:
for completeness in theory
while remaining:
inconsistent in practice
A useful reframing
Instead of asking:
“Do we have a playbook for this?”
Ask:
“Who makes the decision when the playbook does not apply?”
This shifts the focus from:
process
to:
capability
What good practice looks like
Strong incident response capability does not remove uncertainty.
It makes it manageable.
This is visible when:
decision ownership is clear
actions remain coherent without direction
communication reflects shared understanding
the organisation can explain why a path was taken
The difference is not speed.
It is consistency under pressure.
The role of preparation
Preparation remains necessary.
But its purpose is often misunderstood.
The value of:
exercises
playbooks
simulations
is not in perfecting execution.
It is in:
developing judgement under uncertainty
Closing thought
Incidents do not test whether an organisation has prepared.
They test whether:
preparation has translated into capability
A playbook is useful.
It is not decisive.
Leadership is.