Halloween 2026
It is late October. Across the neighborhood, synthetic spiderwebs stretch across the shrubs, orange lights glow, and five-foot plastic skeletons dangle from porches and tree limbs. These skeletons are harmless. They let us enjoy a little fright without any real consequences.
The skeletons that matter don’t hang on the front porch. They sit in the back of dark closets, behind doors we’ve quietly agreed not to open.
For a business owner, those skeletons might be an old employee whose remote access was never revoked, a backup nobody has tested, or a nagging question about what would happen if the systems stopped working tomorrow.
During the day, there are customers to serve, orders to fill, employees to manage, and a hundred things demanding attention. The business is running. There is always something more urgent.
Then 3:00 AM rolls around.
You wake with your chest tight, staring at the ceiling fan. It isn’t always a fully formed thought. Just an unsettling feeling that sharpens into questions:
Did we ever test whether that accounting backup can actually restore? When Dave left three years ago, did anyone turn off his remote access? If an email that looks like it came from a supplier asks us to change their bank details, would anyone call to verify before the next payment goes out?
You lie awake for forty minutes, drift back into an uneasy sleep, and wake up remembering little more than a bad night.
By breakfast, the machinery is humming, the orders are moving, and the questions have gone back into the closet.
Until the day luck runs out.
What You Don’t Know Can Still Break You
There is a common reflex in business, and IT is no exception: if I don’t look, maybe it isn’t broken.
Call it the Hope Protocol.
We hope nobody notices the old opening in the firewall. We hope the customer portal doesn’t fail at the worst possible moment. We convince ourselves that because the shop made parts yesterday, the packing slips printed, and payroll cleared at noon, everything must be fine.
But “It worked fine today” is not an engineering assessment. It’s an observation of temporary luck.
Problems don’t need to be visible to be real. An access account can remain active for years without being used. A backup can report success without anyone knowing whether the business can be restored from it. A network can function perfectly well while allowing a compromised office computer to reach systems it should never touch.
The absence of a failure is not proof that the conditions for one don’t exist.
You don’t have to fix every problem this week. But you do have to stop letting unanswered questions masquerade as good news.
Three Closets Worth Opening This Week
Before the trick-or-treaters arrive and the year-end rush consumes your calendar, take thirty minutes to start asking questions. Step away from the daily triage and open three doors while the lights are on.
1. The “Ghost in the Machine” Closet: Access and Identity
Start with your core business applications, email, remote-access tools, and banking portals.
Are there former employees, temporary accounts, or contractors whose work ended years ago but whose access might still be active?
Ask whoever manages these systems to check. Disable access that is no longer authorized, revoke active sessions and other credentials where applicable, and preserve the records needed for auditing and retention.
Don’t assume that removing someone from the payroll automatically removes them from every system.
The question to answer: Who can still get into our business systems, and are they the correct people we authorized?
2. The “Shared Hallway” Closet: Connections and Reachability
Ask your IT provider a plain question:
If an office computer were compromised, could the intruder reach the equipment that runs production?
In some shops, office computers and shop-floor equipment share network paths that allow more access than the business intended. That can turn a problem on an ordinary workstation into a threat to systems that keep production running.
The engineering answer is appropriate network segmentation: separating systems according to what needs to communicate with what, then enforcing and testing those restrictions.
While you’re at it, walk the facility. Identify the equipment that production depends on, where it connects, and which systems would have to keep working if the office network went down.
A walk-through won’t establish that the network is secure. But it can reveal how much of the business depends on connections nobody has stopped to examine.
The question to answer: If one computer goes bad, how far can the damage spread?
3. The “Unchecked Assumption” Closet: Backup and Recovery
A backup that has sat connected to a server for three years is not, by itself, a recovery plan. Ransomware can affect backups that are reachable through compromised systems or credentials. And a backup that reports success may still leave you with a long, complicated recovery.
Ask your IT provider:
When did we last restore from these backups? What did we actually recover, and how long did it take?
Go beyond restoring a file. Find out whether the systems and data your business needs to operate can be recovered in a useful order and within a timeframe the business can tolerate.
Then put a dollar figure on a day of stopped production. Include more than lost sales: idle labor, delayed shipments, missed commitments, and the cost of getting operations back on their feet.
You don’t need a perfect estimate. You need a realistic sense of what downtime costs and whether your recovery arrangements match the stakes.
The question to answer: If we had to recover the platform tomorrow, do we have a tested way back to work?
Open the Door in Daylight
The things lurking in our closets are rarely unstoppable monsters. More often, they’re ordinary problems that have been postponed because everyone was busy, the jargon was intimidating, or nothing had gone wrong yet.
Asking the question doesn’t create the problem. It brings the problem into view, where something can finally be done about it.
You don’t have to solve everything in one afternoon. Find the gaps. Decide which ones matter most. Assign someone to close them. Then verify that the fix actually worked.
The plastic skeletons can stay on the porch.
The ones in the closet are the ones worth dealing with before they decide to come out on their own.
#BusinessContinuity #CyberResilience #SmallBusinessOperations #OperationalRisk #Leadership