Waiting for the Unexpected: Paths to a Preventive Culture

In March 2019, the downtime that occurred on Facebook for more than 14 hours affected users around the world and kept networks like Instagram, Messenger and WhatsApp unavailable. At the time, the crisis caused an estimated financial loss of approximately US$90 million. 

When we talk about a crisis, we understand it as a set of threats to the business, reputation and/or survival of an organization. Briefly, it is possible to consider its definition as a situation that causes a break with normality, and that has the potential to cause numerous losses – including financial. 

Edgar Morin, a French sociologist and philosopher, dedicated his life – and still does, at the height of his 101 years – to studying complexity. For him, one of the great challenges that surround us is to take the risks of navigating the uncertainties of everyday life. Among them is the awareness that one of the few events we can expect is the inevitable. 

If, as a society, the difficulty is negotiating with uncertainties, the business scenario follows the same flow. As living organisms, organizations are pulsating systems that can organize and move from the transformations of social, everyday life. 

A social context marked by profound transformations in the ways of relating as individuals and in technological development is reflected in the structure of the business environment. Productivity, profitability, and short term are common characteristics in the life of companies. On the other hand, unpredictability is not a part of everyday business vocabulary, even though it should be. And it is in this context that living with and managing crises becomes a common part of the organizational routine. 

In this scenario, the advancement of science and technology has profoundly altered the way of living, feeling, and relating to a large part of the population, democratizing access to information generated by the internet, at the same time that different techniques and technological tools available have intensified visibility and hyperconnection. It is against this backdrop of unpredictability that living with the risks of the uncontrollable and effectively preparing for moments of crisis also becomes part of the organizational routine. 

For example, in 2022, Netscout released the Distributed Denial of Service (DDoS) Threat Intelligence Report, analyzing the impact of cyberattacks on public, private and governmental organizations around the world. The result indicated that in Latin America there was an increase in DDoS attacks of approximately 19%. Among the countries surveyed, Brazil, Colombia, Mexico and Argentina are among those that concentrate the highest volume of attacks. 

In this sense, the consequence may be the unavailability of IT environments, causing the impossibility of access by users and the downtime of the application/service/site. That is, we have a crisis going on in the organization as the result of a possibly unforeseen abnormality.

Let's go further: downtime, a generalized unavailability that affects an entire production chain, can be considered a consequence of the lack of a preventive culture in organizations. In August 2016, for example, the unavailability of the operations center of Delta Air Lines, an American airline, caused the cancellation of flights and a cost of approximately US$150 million. 

Predicting and remedying possible downtimes and measuring their costs has been part of the trends in information technology for many years. Even so, there are few organizations that can say that they are working on ways to avoid unavailability in systems, nor have clear information about their financial impacts or on the companies' business/product reputation. 

Within a year, according to an IBM survey, companies experienced a 29% frequency of unplanned downtime. In 2022, a survey released by the Uptime Institute revealed that 1 in 5 datacenter organizations worldwide has suffered, since 2019, at least one moment of unavailability considered serious or severe, involving financial losses, damage to reputation, and others. 

According to a survey conducted by Statista, 10% of companies had an hourly cost of up to US$5 million, while 25% of global companies had an hourly downtime cost of  up to US$400,000.

Contrary to what we might imagine at first, crises rarely occur due to surprise factors. On the other hand, it is important to seek prevention and care mechanisms, either to avoid crises or, at least, to reduce the damage caused to the organization. One possible way  to do this is the development of a culture of care. 

When we think of a preventive culture, we establish analysis movements within organizations that precede risks and ruptures, avoiding problems that may be known to companies. An organization, as a social group, has the power to develop and maintain a work culture that follows the company's values and contributes to business growth. 

Here are some possible ways to develop a preventive culture in organizations. 

1. Understanding who are the responsible actors

Crisis and incident prevention does not need to be focused on a specific sector but can receive input from everyone involved in certain processes. The first step is to understand who is responsible for each step within the system and involve these people in gathering information.  

2. Staff training

With the professionals located, it's time to educate these people so that they understand what incident prevention is all about and can find their own solutions, when necessary.  

3. Promote existing initiatives

By talking to the actors involved in the different areas within an organization, it is possible to identify actions that may be taking place and that contribute positively to the culture of prevention. Sometimes, the solutions sought and the tools needed may be within the organization itself. 

4. Seek technological support

In a culture of prevention, technological tools enter into strategic partnerships with the areas to simplify the collection and analysis of available data, concentrating, whenever possible, on a single view that is available to all involved.  

5. Plan the deployment of solutions

By understanding what is done within the company, those responsible for each step, and the tools available on the market, the last step is to plan how actions aimed at preventing incidents will be implemented and applied in everyday life, considering the possibility of periodic reviews and adaptation to each of the tools used. If crises are inevitable, planning can be one of the possible paths for corporate survival itself.

The development of a preventive culture together with the right tools is in constant transformation, constantly feeding back and learning from the information seized. There is a space to be filled between the technical teams – responsible for containing the knowledge behind the solutions – and management – responsible for decision-making. And this space can be filled with a culture of prevention.

Delayed action at the time of the crisis will not be as assertive as a predictive action combined with quality information shared with leaders for decision-making. If one of the few existing certainties, as Morin reminds us, is the existence of the inevitable, organizations, even if they develop their processes with excellence in management and safety, will face crises and critical events that may – or may not – threaten their business. 

The culture of prevention is a valuable ally for business and can determine the success of organizations – and their survival in the midst of uncertainties.