Nobody Reads the Plan During the Fire with Patrick Lechner
Aug 9, 2026 · 40 min · 9 segments
In this episode of The Entropy Podcast, Francis Gorman speaks with Patrick Lechner, co-founder of Resimate.io and an experienced business and cyber resilience leader, about why many organisations…
In this episode of The Entropy Podcast, Francis Gorman speaks with Patrick Lechner, co-founder of Resimate.io and an experienced business and cyber resilience leader, about why many organisations mistake documentation for genuine readiness. Patrick challenges the obsession with business continuity plans, impact assessments and compliance evidence, arguing that resilience should be measured by outcomes: can the organisation continue operating when something critical is lost? The conversation explores the difference between security and resilience, why businesses should prepare for loss rather than attempt to predict every possible threat, and how leaders can identify their most important dependencies. Patrick also examines the role of AI, the importance of business ownership and why tabletop exercises must become honest operational conversations rather than annual corporate theatre. This is a practical discussion about building the confidence, capability and human relationships required to respond when the plan no longer matches reality. **Key takeaways** - Resilience is not a collection of documents. Plans and frameworks are useful, but they do not prove that an organisation can sustain operations during a crisis. - Prepare for loss, not every imaginable threat. Most disruptions can be reduced to losing a site, people, systems, suppliers or data. - The business owns resilience. Operational leaders should decide what must continue, what level of disruption is tolerable and where investment is justified. - Cybersecurity and cyber resilience are different. Security attempts to prevent incidents; resilience determines what happens when prevention fails. - Dependencies must be understood across the organisation. A single failure—such as electricity, identity infrastructure or a major supplier—can create very different consequences across multiple teams. - AI can amplify weak processes. Automating a poor resilience process may produce more plans and evidence without improving operational capability. - Tabletop exercises should be frequent and honest. Short, regular discussions are often more valuable than one heavily scripted annual exercise. - People ultimately carry the response. Trust, authority, shared principles and operational knowledge matter more during a crisis than a spreadsheet stored somewhere on the network. **Soundbytes:** “We were tired of resilience being measured by plans, not outcomes.” “Plans may be useless, but planning is indispensable.” “Almost every threat can be reduced to a handful of loss scenarios: losing a site, people, systems, suppliers or data.” “The board-level question is simple: how confident are we that we can sustain operations if we lose a key dependency?” “It does not matter why the electricity is gone. If it is gone, the business still has to respond.” “Investing heavily in prevention does not mean you are resilient.” “If you have bad processes today, AI is a great tool for accelerating those bad processes.” “You do not become fit by going to the gym once a year for seven hours. Tabletop exercises work the same way.” “An exercise should be an honest conversation, not a performance conversation.” “When something hits, it is the people, the trust and the shared principles that allow the organisation to respond.”
In this episode of The Entropy Podcast, Francis Gorman speaks with Patrick Lechner, co-founder of Resimate.io and an experienced business and cyber resilience leader, about why many organisations…
