This week’s post is a little different from our usual left of bang briefings. In response to the increasingly specific warnings and actions coming out of Europe about the threat of Russian attacks, we wanted to share an episode of Baselines & Anomalies with all subscribers.

Episode Summary

In this episode, we look at a series of increasingly specific warnings from European leaders about the threat posed by Russia and the possibility of attacks expanding beyond Ukraine.

European concern about Russia has been part of the baseline for years, but the anomaly is the growing specificity of the warnings and the observable actions governments are beginning to take in response. We use that shift as a practical example of how Watch Points can help leaders recognize when a changing environment deserves more attention.

From there, we walk through three layers of assessment: where you may be exposed, which assumptions could be wrong, and what second-order effects could reach you even if you are far from the immediate threat.

Key Takeaways

• Watch Points change attention. Increasingly specific warnings and observable government actions can signal that conditions are changing enough to justify closer monitoring.

• Assess exposure before certainty arrives. Identify where your people, assets, dependencies, and assumptions could become vulnerable if the security environment deteriorates.

• Define Action Points in advance. Establish the thresholds that would cause you to act so you can create more time and more options if the situation worsens.

Mentioned in this Episode

Reflective Question

What change in Russia’s behavior or Europe’s security environment would cause you or your organization to move from monitoring the threat to taking action?

This webinar is part of The CP Journal’s Academy, which brings together the resources professionals need to improve their operational readiness, recognizes threats and hazards, and get left of bang.

Webinar Summary

This webinar explores how organizations can operationalize the left of bang approach by moving important decisions and actions earlier on the timeline.

Using wildfire as the primary case study, Patrick Van Horne walks through a three-step process to turn preparedness from a general aspiration into a practical decision-making process. Participants will see how to define risks more precisely, recognize meaningful changes before a situation becomes obvious, and assess whether their organization has the plans, people, resources, skills, and validated capabilities needed to act in time.

Although wildfire is used throughout the presentation, the framework is designed to apply broadly across threats and hazards, including workplace violence, severe weather, flooding, cyber incidents, and infrastructure disruptions.

Key Takeaways

• Define what you are trying to get ahead of. Move beyond broad threat categories and identify the specific event or consequence your organization is unwilling to be right of bang to.

• Establish what should change attention and behavior. Use Watch Points and Action Points to identify the conditions that should cause your organization to pay closer attention, escalate concern, and begin acting.

• Make sure you can act while there is still time. Identify the actions that could change the outcome, then assess whether your plans, people, resources, skills, and capabilities are ready to execute them when needed.

Read more

I don’t think it is controversial to say that “things are changing” in the world. Technology is changing. The threats and hazards that organizations face are evolving. Politics, budgets, the workforce, the way people communicate, and what they expect from organizations all seem to be in a continual state of flux.

But saying that “things are changing” isn’t particularly helpful either. When I think about the conversations we’ve had with our clients, even though I can’t think of a time when there was a debate about whether change was occurring, I can think of many times when the leader was trying to figure out what they should do about it.

I’ve found that it can create a sense of anxiety for leaders trying to decide what needs to change for their teams and organizations.

• Make a change too early and you might spend money, consume staff capacity, launch projects, and disrupt things that are working in order to prepare for a future that never arrives.

• Wait too long and you may discover that the plans, skills, technology, staffing, or organizational structures that worked in the past are no longer good enough.

There isn’t a single, universal answer that can make it easier for leaders to decide what the priority should be or where limited resources should go. What an organization needs to do to prepare for the future is unique to them.

This challenge becomes harder still when you realize a lot of people struggle to explain what they are seeing. You can have a sense that the operating environment is changing, but if you don’t have a shared vocabulary for describing it, then it is difficult to explain why something matters, compare observations with other people, challenge assumptions, or build a shared understanding of what the organization should do about it.

I think leaders often experience this uncertainty as a forecasting problem: “If I could just figure out what is going to happen, I would know what to do.” But I think it is better understood as an orientation problem.

You don’t need to know exactly what the future will look like, but you do need a way to understand the environment you are operating in, recognize when something important is changing, talk about those changes with the people around you, and determine what they might mean for what you do next.

That is how we begin getting left of bang to those changes.

In this briefing, I’m going to introduce the six elements I use to assess the operating environment and the practice I use to continuously make sense of how those elements are changing. Then we’ll take that understanding one step further and look at how to turn observations about change into decisions about what you and your organization should actually do about them.

If you’re into this, buckle up because this week’s briefing is not short.

The Need to Anticipate & the Snake Oil of Prediction

The underlying premise to everything that follows is that getting ahead of the changes in our operating environment requires us to do something before their impacts fully arrive. We might need to build a new capability, develop our workforce, invest in technology, change a plan, or position our organization differently.

Every investment in capability is implicitly a bet about the future. We are making a judgment that something will be important enough tomorrow to justify spending time, money, attention, or credibility on it today. That means that getting left of bang requires some degree of anticipation.

Without it, we would be closing our eyes, spinning around, and throwing darts. We might hit the bullseye every billionth time, but we would more likely miss the dartboard altogether and probably hurt someone. Mostly, we would waste a lot of darts.

So we need to think about what may be ahead, but there is an important distinction between anticipation and prediction.

• Anticipation considers possibilities and prepares for them.

• Prediction claims to know what will happen.

Every minute I spend on the internet makes me increasingly wary of the second.

There is an enormous market for people willing to tell us what the future will look like. It has existed since the beginning of time. People will tell you where the economy is headed, what AI will do to your profession, which country will go to war, what political event will change society, which technology will make your business obsolete, or what crisis is coming next.

The more confidently they say it, the more compelling it can become. But it’s worth remembering that the prophet has the opportunity to profit. Fear and certainty can get attention and build audiences. That attention can bring them money, or influence, or power, or create dependency with their audience.

That doesn’t mean every person making a prediction is consciously manipulating an audience, but we should be skeptical of the incentives at play when someone claims to know what is coming. We should question it further when fear, certainty, and continued attention benefit the person making the claim.

There is no crystal ball. No one secretly has access to the future and is generously sharing what they saw there with the rest of us. If they did, I have a hard time believing their first choice would be to post about it on social media or explain it on cable news.

Still, I understand why we listen.

If you’re responsible for preparing an organization for what comes next, having someone else hold the flashlight is incredibly appealing. There can be a sense of relief to have someone tell you where to look, what to worry about, and what to prepare for. And if they’re wrong, you weren’t the only one who got it wrong. You followed the expert. You followed the forecast. You followed what everyone else believed was coming.

I recognize that defensibility can be important when your decisions consume real money, affect people’s careers, change organizational priorities, and put your own reputation on the line. The problem, however, is that prediction doesn’t actually give us certainty. At best, it only gives us the perception of certainty.

And when we become dependent on someone else’s predictions, we also give up our agency. We allow someone else to decide what deserves our attention, which changes matter, what we should fear, and ultimately which future we should prepare for. I don’t know many leaders who are truly comfortable giving that power away.

The goal is to regain our agency over this process. Instead of asking someone else to tell us what is going to happen, we can become better at understanding the environment we are operating in, noticing how it is changing, and determining what we are going to do about it.

We don’t need someone else to hold the flashlight for us. We need to get better at seeing for ourselves. And that starts by defining the operating environment in a way that allows alert and reflective observers to identify the changes that are important to them.

The Six Elements of the Operating Environment

If we are going to get better at seeing for ourselves, we need some structure for what we are looking at.

An operating environment is too complex to take in as a single thing. There are too many forces, too many variables, and too many changes occurring at the same time. Without some way to break it apart, almost everything can feel important—or nothing does.

I’ll acknowledge up front that there are already plenty of frameworks for doing this. Military planners use models such as METT-TC and ASCOPE. Businesses use tools like PESTLE, SWOT, and Porter’s Five Forces. Even though each was developed for a purpose, and each can be useful for the problem it was designed to solve, none of them met what we needed for the left of bang framework.

We needed a practical way to identify the parts of the operating environment that are most likely to change what an organization needs to notice, decide, or do. And we needed to see those changes clearly enough to understand what they might mean.

Today, we frame the operating environment around six elements:

1. Threats & Hazards. The natural, technological, human-caused, and organizational risks that could disrupt operations, cause harm, or create consequences for the organization and the people it serves.

2. Media & Communications. The information environment surrounding the organization and its operations, including how information is created, shared, received, interpreted, and amplified through traditional media, social and emerging media, internal communications, and other channels.

3. Resources & Technology. The resources, systems, infrastructure, equipment, technology, financial capacity, or external services the organization depends on to operate.

4. Community or Customer Expectations. The needs, expectations, behaviors, priorities, and perceptions of the communities, customers, stakeholders, or populations the organization serves.

5. Politics & Policies. The laws, regulations, policies, authorities, political priorities, leadership decisions, and broader governance environment that enable, constrain, or influence what the organization can and is expected to do.

6. Workforce. The people required to operate the organization, including staffing, availability, skills, experience, morale, retention, recruitment, and other factors affecting the workforce’s ability to perform.

Even though these six elements don’t have the necessary vowel to turn them into an acronym—a significant limitation—the labels don’t require much translation before people can begin using them. A police chief, hospital executive, emergency manager, business owner, or nonprofit leader can all understand what we mean when we talk about workforce, technology, community expectations, or policy.

That simplicity is intentional because we want a framework that can be used continuously, not just during a strategic-planning session or a formal assessment. We wanted something that can help us or someone else read an article, sit through a presentation, hear an observation from a team member, or watch a tech demo and ask: Does this represent a change we should take note of?

The six elements are also better thought of as lenses. AI, for example, may first look like a “Resources & Tech” issue. But it can also change the workforce by altering skill requirements. It can affect “Media & Communications” through synthetic content and misinformation. It can change customer expectations about speed and service, create new threats, and drive new political or policy decisions.

I don’t want to spend any time deciding or debating which box AI belongs in, but I do want to examine it across the parts of the operating environment that are important to us. Over time, these six elements help us establish the baseline—your developed understanding of current and expected conditions—for our operating environment and make it easier for us to notice the changes that can affect us.

And once we are able to recognize those changes and talk about them in a way that lets us understand them, we can begin asking the question we actually care about: What, if anything, should we do about it?

Why Start Now

If the goal is to recognize a change in the operating environment early enough to do something about it, we do need to talk about timing.

Everything that goes into getting left of bang takes time. Recognizing the change, assessing whether it matters to the organization, deciding what to do about it, and actually implementing that decision—building a capability, completing a project, changing a process, hiring someone, buying technology, training a team—all require time. And it all has to come from somewhere.

As we discussed in Briefing #85, the amount of time your organization needs to go through those steps determines how far left you need to begin.

• If your organization has developed these abilities and can move through the process quickly, you can wait for more information before acting.

• If it takes your organization months or years to make and implement a meaningful change, you cannot necessarily wait until everyone agrees about what is happening, and may have to make the decision while the signals are still weak.

That is why the time to build this practice is before you need it. The goal isn’t always to make every decision earlier, but to get better at completing the Recognize → Assess → Decide → Act sequence fast enough to act while you still have options.

You now have the six elements to help determine what to watch. The next step is building the practice that helps you consistently determine what matters and what you do about it.

Read more

The phrase “If You See Something, Say Something.” has been on repeat in my head this week.

I spoke with a client early in the week about why information does—and doesn’t—move through an organization when pre-event indicators are observed, and the phrase has been embedded in my brain like the hook to a catchy pop song ever since.

Before I explain why organizations and leaders should consider taking a step beyond this concept, I want to acknowledge the importance of the tagline itself.

Initially used by the New York City Metropolitan Transit Authority (MTA) in the months following 9/11, and later licensed by the U.S. Department of Homeland Security in 2010 to support a nationwide anti-terrorism campaign, “If You See Something, Say Something,” helped bring the idea that ordinary people have a role to play in preventing attacks into the mainstream.1

The importance of crossing that threshold can’t be overstated.

Getting people to realize that terrorism, crime, and violence prevention requires a whole-community approach—and that individual people have a role in that effort—was critical. Without that shift, any follow-on efforts to teach people how to recognize warning signs would have fallen on deaf ears. Prevention would have remained something people assumed belonged exclusively to public safety professionals and government agencies.

But inside an organization, letting people know they have a role to play in the organization’s ability to get ahead of emerging threats and opportunities is not enough. Messages like that do not, by themselves, solve the capability problem.

Recognizing a need to be aware of your surroundings and having a functioning program that consistently identifies meaningful pre-event indicators are two very different things. To operationalize the left of bang approach, leaders need to rethink what their organization’s equivalent of “See Something, Say Something” actually requires.

There are three things to consider.

First, until the organization can “say” what it is looking for, its people will never be able to “see” it.

Take whatever threat or hazard is your organization’s equivalent to terrorism. If you tell people to be on the lookout for “suspicious people,” the reports you receive will inevitably reflect the personal experiences, assumptions, and biases of the people doing the observing. This is the result of unintentionally placing the burden of determining what is worth reporting on the individual.

But in an organization that is genuinely committed to getting left of bang, the responsibility starts at the organizational level.

Leaders have to define the pre-event indicators they want people looking for, and those definitions need to be specific. Until an organization develops a common language around what is important—and until that language creates a shared understanding of what is being observed—the chances of people consistently recognizing important indicators will remain limited.

Without that clarity, the organization is hoping people notice the right things. That is very different from intentionally building the capability to recognize them.

Second, until the organization demonstrates what it will do with the information, it reduces the chances that anyone will actually “say” anything.

People make a risk-and-reward calculation when deciding whether to share something they have observed, and trust plays a major role in that calculation. If someone doesn’t trust that the information will be assessed fairly, believes reporting it could create problems for them, or expects that nothing useful will happen as a result, the likelihood of them speaking up goes down.

The consequences don’t have to be severe either.

Sometimes the risk is simply developing a reputation as “Chicken Little” and becoming the person who is always sounding an alarm. They can become known as someone with poor judgment, and their credibility becomes discounted in other parts of their job.

That is especially problematic when the person being asked to recognize pre-event indicators doesn’t work in security, emergency management, public safety, or crisis response every day. We are asking people outside those fields to notice something unusual, raise their hand, and accept the possibility that they might be wrong.

If the organization punishes that behavior, either formally or informally, it should not be surprised when people stop doing it.

Leaders can reduce that risk by making the assessment process more structured and transparent. People should understand who receives the information, how it will be assessed, and what happens next. The more predictable and credible that process becomes, the easier it is for people to speak up when something does not look right.

Third, organizations have to be realistic about how much they expect people to notice.

People can only process so much information at any point in time.

As we get ready to start another NFL season—and as I get ready to win another fantasy football championship—think about a new quarterback entering the league.

An inexperienced quarterback can only make so many reads of a defense while also remembering the play, managing the pocket, watching the pass rush, and trying to move the ball down the field. Over time, experience allows that quarterback to process more information and recognize more subtle indicators, but early on, the coach has to be selective about what is and isn’t critical to notice.

The same principle applies to organizational awareness.

There is no shortage of information available. There are countless data points that could potentially provide an early warning of a meaningful shift in the environment, and observations could come from every part of the organization.

But since attention is finite, the goal cannot be to get everyone watching everything.

Leaders have to decide which observations are most valuable, which indicators deserve attention, and which changes should cause someone to look more closely or share what they are seeing. Choosing and prioritizing those high-value observations is an organizational responsibility.

Organizations that want to shift earlier on the timeline and get ahead of future events can build on the lessons of “See Something, Say Something” while making the concept more practical and operational.

We can’t forget that it’s not enough to simply tell people to pay attention.

Leaders have to define what is critical for the organization, teach people what to recognize, focus limited attention on the indicators that matter the most, and build a reporting process that people trust enough to use.

That is how awareness becomes an organizational capability.

This process of operationalizing the left of bang framework is the focus of our upcoming webinar. We will use wildfires—and specifically wind-driven fires—as the risk throughout the presentation, but the process is designed to be replicable across the threats and hazards your organization is preparing for.

We certainly hope to see you there.

Until next week, get left of bang, and stay there.

—Patrick

This episode is part of Baselines & Anomalies, a video series that examines events through the left of bang framework.

Episode Summary

New World screwworm was effectively pushed out of the United States decades ago through a sustained eradication and containment effort. As the threat receded, the likelihood and impact of domestic outbreaks fell, and readiness declined with them. For years, that was a rational allocation of resources.

Now the baseline is changing. After the biological barrier in Panama was breached in 2023, screwworm moved north through Central America and Mexico before returning to Texas in 2026.

This episode looks at the leadership problem that follows: risk can change faster than readiness can be rebuilt, and leaders need to understand not only what threats they face, but how long it will take to restore the capabilities required to respond.

Read more

Ohio peace officers who complete the online course can receive 8 hours of CPT credit in the Compliance & Control Tactics category.

The course is listed on Ohio’s 2026 CPT Agency Pre-Approval List as:

26CPT1767 — The Tactical Analysis Course – Basic Online

The Tactical Analysis Course teaches a structured approach to observation and assessment—helping officers establish baselines, identify anomalies, recognize behavioral indicators, and make better-informed decisions about the people and situations around them.

For Ohio agencies, this approval makes it easier to incorporate Tactical Analysis into existing professional development programs while allowing officers to earn the required continuing training credit.

Interested in Tactical Analysis training for your agency?

Group pricing is available for law-enforcement agencies.

Contact us at training@cp-journal.com to learn more.

The more time you need to successfully evacuate people, the earlier you must decide to do it. And the earlier you must decide, the less certain you can be that an evacuation will be necessary.

When a public safety agency decides to evacuate an area—and it doesn’t matter if it is because of a flood, an attack, a hazardous materials incident, a wildfire, or something else—that decision is often assessed in one of three ways once the incident is over:

• The evacuation was successful. The incident demonstrates why the evacuation was necessary, and people had enough time to reach a safe location.

• The evacuation was deemed unnecessary. The incident never developed in a way that put the evacuated population at risk. In hindsight, people realize they could have stayed where they were.

• The decision to evacuate was made too late. People did not have enough time to get to safety.

There is a fourth option, which I’ll come back to in a minute, but these scenarios highlight a paradox that professionals have to navigate when operating left of bang.

• If you wait until you are certain an evacuation is necessary, you are often too late.

• Therefore, consequential decisions—such as evacuating an entire neighborhood or community—often have to be made before leaders can know with certainty that the action will ultimately be needed.

• Yet those decisions are often judged after the incident is over, when the uncertainty that surrounded the decision has disappeared and everyone knows how the incident actually unfolded.

To understand why leaders may have to accept so much uncertainty, it helps to work backward from the moment people actually reach safety.

How far left of bang do you need to be?

Evacuation scenarios provide an excellent example of left of bang decision-making because if you wait until your house or neighborhood is on fire to evacuate, you are likely already too late. The decision to move people to safety has to be made before that moment in time.

The question, then, is how much earlier? How far left of bang do you need to be?

To answer that, you have to account for the time required to complete an evacuation across four different components.

• How much time does it take to physically evacuate? Moving a given number of people and vehicles from Point A to Point B along a fixed set of roadways takes time. It might be minutes, or it could be hours.

• How much time does it take for public safety leaders to make the decision? Before an evacuation decision is made, someone has to size up the incident, assess where it may go next, determine what is at risk, and identify the geographic area that may need to evacuate.

• How much time does it take to communicate that decision to the public? Once the decision is made, it often has to be communicated to the agency responsible for issuing the alert (such as a 911/dispatch center), entered into the appropriate system, approved, and delivered to the public—potentially through telecommunications networks already experiencing heavy demand.

• How much time does it take for people to begin leaving? Receiving an evacuation alert does not mean someone is immediately in their car and moving. People assess the message, make the decision to leave, gather family members, pets, medications, and other essentials, and then begin evacuating.

Each of these steps consumes time. While the scale and scope of the incident and the readiness of both the agency and the community will determine how long each one takes, none of them happens instantaneously.

And those time requirements are cumulative. The longer it takes people to make the decision, communicate it, get people moving, and physically evacuate the area, the further left of bang the original decision point has to move.

That creates an important relationship that deserves to be called out. The more lead time the system requires, the earlier leaders have to act. And the earlier they have to act, the less complete the information will be, the more uncertain the forecast becomes, and the less evidence they may have to justify why the evacuation will ultimately be necessary.

Which raises a different question. If leaders are required to make decisions before the outcome is knowable, how should we determine whether they made the right one?

Is the outcome the right performance metric for left of bang decisions?

Imagine this scenario. A wildfire is moving toward a neighborhood.

Based on the wind and weather, the vegetation, fire behavior, and the roads available for evacuation, public safety leaders order the neighborhood to evacuate.

Three hours later, the wind shifts, and the fire changes direction. As a result, the neighborhood never burns.

Was the evacuation decision wrong?

That answer depends on whether you judge the decision based on hindsight or based on what was knowable at the moment the decision had to be made.

There are four ways an evacuation decision can intersect with what ultimately happens:

• If the hazard materializes and the agency acts early, success is obvious.

• If a hazard materializes but the agency delays or doesn’t act, failure is obvious.

• If a hazard doesn’t materialize but the agency acted early, the decision may look unnecessary.

• If a hazard doesn’t materialize and the agency either delayed the decision or didn’t act, the decision may look correct.

That last option is particularly dangerous because an agency might decide not to evacuate, get lucky when the hazard never materializes, and walk away believing it made the right decision. Organizations can make bad decisions and still receive good outcomes.

The opposite can also be true.

An agency can make a sound decision to evacuate based on the information available at the time, only for conditions to change and the evacuation to ultimately prove unnecessary. The outcome does not necessarily mean the decision was wrong.

This is why organizations looking to move left of bang need to distinguish between decision quality and outcome quality.

A good decision is one that was reasonable given the information available at the time, the consequences of waiting, the time remaining to act, and the criteria established for making the decision—not simply one that produced the desired outcome.

That distinction should also change how we evaluate these decisions after an incident. Instead of only asking, “Did we end up needing to evacuate?” we should also ask: “Given what we knew at the time, the time remaining to act, and the consequences of waiting, did we make the right call?”

Organizations cannot eliminate uncertainty surrounding left of bang decisions, but they can build a process for making better decisions within that uncertainty.

How do you operate left of bang?

If you cannot eliminate uncertainty, the objective is to build an organization capable of recognizing what is changing, understanding when a decision is approaching, and acting while there is still enough time to influence the outcome.

That leads to the very practical question sitting at the center of our upcoming webinar: How do we build a system that helps us make those decisions earlier and better?

On September 17th, we’ll explore that in our webinar “Before the Flames: Applying Left of Bang to Wildfire.”

Through the lens of a wildfire, we’ll look at three critical steps leaders and decision-makers can take to help their organizations recognize emerging risk, make decisions under uncertainty, and act before the window to influence the outcome closes.

If that challenge affects your work—or the work of someone you know—we hope you’ll join us and share the session with others who may benefit.

As always, thanks for reading, and we’ll see you next week.

On September 17th, Patrick Van Horne, co-founder of The CP Journal and co-author of Left of Bang, will walk through a practical framework for applying the left of bang concepts to get ahead of wind-driven wildfire.

Using a wildfire approaching the built environment as the case study, the session will show how organizations can define the wildfire consequences impactful for their community, identify meaningful Watch Points and Action Points, and make better operational decisions while there is still time to influence the outcome.

In this session, you will:

• Learn how to define the specific wildfire consequences your organization cannot afford to be right of bang to

• Understand how Watch Points and Action Points can turn situational awareness into an organizational asset

• Explore how to connect early warning, decision-making, and operational capability so action happens while there is still time to influence the outcome.

Webinar Details

• When: Thursday, September 17th, 2026 | 11:30 a.m. ET / 8:30 a.m.

• Who: This session is designed for emergency managers, public safety leaders, wildfire preparedness professionals, and organizational leaders responsible for readiness, response, and risk.

• Seats: Limited to 500 live attendees

• Cost: The live webinar is free to attend. The recording will be made available through The CP Journal’s Academy, which is accessible to paying subscribers.

Registration

Reserve your spot to learn how to move from simply monitoring wildfire risk to recognizing when conditions are changing—and acting before the flames arrive.

Reserve Your Spot

Communities—or customers, or team members, or investors—don’t really care whether we have learned how to see threats and hazards coming. They only truly care whether we’re able to do something about them.

While you can’t act on a threat you don’t see, and recognition without action has limited value, it is the gap between them that is becoming increasingly important. Today, how leaders and organizations compress the gap between identifying a potential issue and addressing it has become a baseline expectation.

That reality has been the focus of my attention over the past few months, and while I wasn’t able to protect my writing time enough this week to produce a new essay, we have kept up with our reading on a variety of threats and hazards to support our clients and projects.

So we wanted to share a few of the longer-form articles we’ve read and thought about through this lens of recognition and action.

No single agency or organization can completely control or prevent every threat highlighted below. The more useful question is: What can you do about it? Can you reduce the likelihood of it occurring? Can you meaningfully reduce the consequences if it does? Do you have the capabilities needed to respond to and recover from the incident?

Each of these articles gave us something to think about through those questions. I hope they give you the same opportunity to reflect on what recognizing a threat or hazard should lead you to do next.

A Few Things We Read This Week

Here are some long-form articles and stories we read that can shape how you’re getting left of bang.

What Happened to Al-Qaeda?

As we come up on the 25th anniversary of 9/11 in a few weeks, I appreciated this retrospective on a difficult question: Did al-Qaeda actually succeed in what it set out to accomplish?

The article considers competing interpretations of bin Laden and al-Qaeda’s strategy—whether they successfully provoked the United States into costly wars and long-term strategic overreaction, or whether many of these outcomes attributed to their strategy were far less deliberate than they appear in hindsight.

September 11th is the event that put me on the path I’m on today, so I tend to spend more time reflecting on it than most other incidents. But beyond that personal connection, it fundamentally changed our country—in good ways and bad ones. Twenty-five years later, there is value in asking not only what happened, but what we learned from it and how those lessons should shape what we do next.

Read the article on The Atlantic.

What if America Went Completely Dark?

This New York Times article looks at the vulnerability of the U.S. electrical grid—and what a coordinated attack could mean for our ability to keep the power on and recover when it goes out.

It starts with the 2013 attack on the Metcalf electrical substation in California, where two shooters damaged 17 transformers in an incident investigators later concluded was far more sophisticated than random vandalism, and was an incredible “near miss” for a larger crisis.

What makes the threat particularly relevant today, though, is how much harder recovery has become. Large power transformers are difficult to manufacture and replace, and lead times that were once less than a year can now stretch to several years. At the same time, electricity demand is increasing, putting even greater pressure on the infrastructure we rely on.

The article also looks at efforts to improve grid security, including NERC’s GridEx biennial exercises. I first became familiar with many of these vulnerabilities through leading the development of two iterations of GridEx, so this is an issue I’ve followed closely since. And while the industry has made progress protecting against some threats, technologies like drones continue to change the problem.

For me, that’s what makes this worth reading: readiness includes understanding whether we can absorb the consequences of an incident, and how quickly we can restore what was lost.

Read the article in The New York Times.

What is Ebola and why is the outbreak in DRC causing so much concern?

The current Ebola outbreak in the Democratic Republic of the Congo offers a stark example of why recognition is the lynchpin that an effective response rests on.

Health officials now know through genetic sequencing that the outbreak began in February. But the earliest known suspected victim wasn’t didn’t develop symptoms until April 24th, and authorities weren’t alerted to the outbreak until May 5th. By that point, 50 people had already died.

That delay gave the virus months to spread before the response could begin catching up. And once recognized, responders were already confronting a difficult operating environment that included conflict, misinformation, mistrust of health workers, and a strain of Ebola without an approved vaccine or treatment.

It’s an extreme example, but the lesson applies much more broadly: the longer the gap between a threat emerging and an organization recognizing it, the fewer options you may have when it is finally time to act.

Read the article in The Guardian.

Allison Nixon and Her Work Unmasking Cybercriminals

As cyberattacks become more frequent and more consequential, organizations need people playing defense—but they also need people willing to go on offense.

This profile of Allison Nixon, Chief Research Officer at cyber investigations firm Unit 221B, looks at that offensive side of the equation. Her work focuses on identifying cybercrime trends before they become major problems, unmasking cybercriminals, and finding emerging actors before they are fully on law enforcement’s radar.

The article also explores how attackers select targets, why targeting security professionals and investigators can itself be a warning sign, how the justice system can act as a deterrent, and what other indicators may help identify escalating risk.

It’s a fascinating look at what it means to recognize a threat early—and what can be done with that recognition.

Read the article on Zero Day.

Thanks for reading, and I’ll see you next week.

—Patrick

When major incidents happen in other cities or to other organizations, how does your leadership team determine whether you need to take action or prepare from something similar?

It doesn’t matter whether I’m speaking with police and fire chiefs, corporate security leaders, emergency management directors, or anyone else—this is one of my favorite questions to ask during readiness interviews.

I’m curious about the answer because, in the environment we work and operate in today, there is no shortage of significant incidents to learn from. The news is unrelenting with reports on new and emerging threats and hazards. There is a nonstop feed of stories about incidents that could have been handled better, along with continual commentary about what a recent incident reveals about the future.

Sometimes, leaders are confronting something genuinely new, though other times it is an old risk that has returned because previous safeguards have eroded, assumptions have changed, or people have simply stopped paying attention to it.

But it is a question that has never not been answered. Every leader has a system they can describe, even when they have never intentionally designed the process.

It doesn’t mean that all the systems are good ones or all of the answers reveal truly effective processes—and the people I’m interviewing are usually the first to provide that assessment—but part of being an executive is learning about incidents and then answering the question: what are we going to do about it?

Leaders have to answer that question first for themselves, then to the people they report to, and finally to the organization they lead. And it’s a gnarly challenge because it requires leaders to separate two important, but distinct capabilities:

• First, they have to become aware of emerging threats, hazards, and disruptions and determine whether those developments pose enough risk to warrant action.

• Then, they have to decide what to do about them—and turn that decision into meaningful improvements in their team’s readiness.

But that is the expectation for leaders today. They are responsible for learning from incidents that occur elsewhere, anticipating how changes might affect their own communities or organizations, and making improvements—sometimes with limited or decreasing resources.

It is a complex problem, but it is also a left of bang problem.

Organizations that don’t go through this process remain reactive and only change after something bad happens to them. Because that outcome is becoming increasingly unacceptable, it requires leaders to continually improve how they first recognize and assess changes, and then decide and act.

For now, I want to focus on the second part of that process because recognizing a threat early is only valuable if your organization can do something with that awareness. In my experience, the organizations that do this well view the ability to prepare as a critical capability.

Why Preparation Has to Become a Capability

There are three reasons why preparation needs to become a repeatable organizational capability.

The first is that, after recognizing a new or emerging threat, you probably don’t know how much time you’ll have to prepare for it. Often, it is only in hindsight that the moment a threat becomes real is clearly determined.

But when looking forward in time, leaders rarely receive a warning with a clear date and time attached to it. So being able to prepare quickly and effectively might be the difference between a completed project and an unresolved issue when the bell rings.

The second reason why preparation needs to become a capability is because the volume and velocity of the threats, hazards, and disruptions organizations are dealing with is very high at the moment.

I talked about this in Episode #3 of Baselines & Anomalies, where we looked at the avalanche of issues leaders had to assess in July. If there is always something new to improve, then organizations need to be able to assess an issue, make a decision, improve their readiness, and close out the project so they can turn to the next problem.

In a slower and more predictable environment, organizations might be able to address one major threat at a time and allow preparation to follow a seasonal rhythm, but that approach doesn’t hold up in an environment defined by volatility and uncertainty. You cannot build a new preparedness process from scratch every time the world changes. You need an organization that already knows how to prepare.

The third reason to develop your organization’s ability to prepare is that the harder it is to make a change, the more that difficulty influences the decision about whether to change at all. I discussed this in this week’s episode of Baselines & Anomalies, where we assessed the risk posed by changes to Substack’s platform.

Moving a website—at least our website—is not easy for us. It takes time, disrupts our work, introduces new costs, and is generally a pain. That means the difficulty of moving platforms has to be considered when deciding whether a change is significant enough to warrant action. The action threshold, for us, becomes higher because the response is expensive.

The same principle applies to preparation. If developing a new plan takes 18 months, if procurement is cumbersome, if training is created from scratch every time, and if organizing an exercise requires a heroic effort, then leaders will naturally wait for a high degree of certainty before acting.

But if preparation is a well-developed capability, leaders have more options. They can confidently make smaller improvements earlier and take incremental actions. They can test assumptions without committing the entire organization to a massive project. They can reverse course if the threat develops differently than expected.

Developing the ability to prepare changes the decisions the organization can make.

How Do You Build Preparation as a Capability?

Preparing as a capability means your organization can identify what must improve, determine what will produce the greatest readiness gain, complete the work using the resources available, and validate that the change produced the intended result. It is the repeatable process used to build and improve everything your organization does.

One way to institutionalize this ability in practice is to build your organization’s modern-day Blue Book. The original Blue Book was developed by Baron Friedrich von Steuben—my spirit Prussian Army officer—after he arrived at Valley Forge and helped turn the Continental Army into a fighting force capable of defeating the British. The Blue Book codified his training principles so they could be taught, repeated, and embraced across America’s new military as it continued to grow.

Today, your Blue Book probably isn’t a physical book, but rather a wiki, an internal playbook, or a collection of repeatable processes that explains how your team prepares.

It can establish things like:

• How new threats, hazards, and lessons enter your decision-making process.

• How you define readiness performance targets, assess your capabilities, and identify high-priority gaps.

• How preparation and readiness projects are selected, scoped, assigned, managed, and completed.

• How plans and procedures are developed and maintained.

• How staff, volunteers, and partners are recruited and integrated.

• How resources are procured, developed, and maintained.

• How training is built and delivered, and how exercises are conducted.

Most importantly, it should reflect how you prepare, based on how you operate during a crisis or disruption. From that foundation, you can build your team’s capacity for continuous improvement. You can teach people how preparedness work gets done, validate their ability to do it, identify friction, and improve the process one repetition at a time.

This is also where adaptation comes from.

Instead of relying on herculean efforts from your team or improvising a new process every time something changes, you build the routines that allow the organization to change deliberately.

This is the work that follows every meaningful change your organization identifies—whether it is a new threat, an operational lesson, a technology shift, or a change in the environment you work in. Don’t leave it to chance. Preparation is one of the two critical elements that allow an organization to capture the left of bang advantage, so build the muscle now.

Which brings me back to the question I ask leaders when something significant happens somewhere else: If your organization needs to change in the future, can it? Is it ready to?

While You’re Here…

Recognizing a readiness gap is only useful if your organization can turn it into completed work. The Project Execution Playbook provides a repeatable structure for scoping, assigning, executing, and closing preparedness projects. We’re continually adding more to this playbook, so give it a look.

This episode is part of Baselines & Anomalies, a video series that examines events through the left of bang framework.

Episode Summary

A change to a critical platform, vendor, or partner can create a new risk for your organization—even when the change itself doesn’t require an immediate response. When Substack unexpectedly introduced an AI-detection feature, it gave us an opportunity to work through the Recognize—Assess—Decide—Act sequence we use at the operational level of left of bang.

In this episode, we break down how we assessed what the change actually meant for The CP Journal, why we decided to stay on the platform, and how the experience exposed opportunities to improve our readiness. We can’t always predict what a partner will do next, but we can develop the ability to recognize change quickly, make sense of what it means, and build the capability to act when a different decision becomes necessary.

Read more

What makes a risk assessment good?

I realize that might not be the most engaging way to open an article hitting your inbox on a Sunday morning, but I’ve been spending a lot of time over the past few weeks thinking about, talking about, and writing about risk beyond what you see on this site. Somewhere along the way, I’ve become a little fixated on the subject.

At least in theory, every major emergency management, public safety, and corporate security decision begins with an assessment of risk.

For these agencies and teams—again, at least in theory—most major investments eventually get justified by the risk they help address. Regardless of whether it is a piece of equipment that gets purchased, a plan that gets developed, an exercise conducted, a staff member that gets hired, or a funding request approved, it is often tied to one or more ways organizations reduce risk.

In every case, someone is making a judgment about what could get in the way of the organization doing what it is supposed to do, so we naturally spend a lot of time trying to understand that risk.

But I’m increasingly convinced that the way we assess risk and the way we actually use those assessments don’t line up very well.

When people talk about developing a risk assessment, the emphasis is usually on the quality of the analysis. Is it comprehensive? Is it data-driven? Did we consider enough scenarios? Did we miss anything important? And I understand why. If you are the person responsible for the assessment, leaving something out feels risky.

But once all of that work is finished, it gets handed to someone who has to make a decision, which is at the core of what I’ve been focused on.

A risk assessment approached as a deliverable gets developed differently than one designed—from the beginning—to support decisions.

When the assessment itself is the deliverable, there is a natural incentive to keep adding to it. More research makes the work feel more defensible, and before long the document is carrying more detail, data, citations, and supporting material because completeness starts to feel like quality.

Yet, even though all of that research is necessary at times, the problem emerges when the complexity required to develop the assessment becomes complexity for the person trying to use it.

You can end up with an analyst who has spent weeks or months buried in the information and who has developed a document so long that few of the people making decisions will ever use it.

But the executive doesn’t have that same benefit. They don’t have the same understanding of the assumptions, the tradeoffs, or the weak spots in the data used to develop that report.

Unless the analyst is attached to the executive’s hip—sitting in the meetings and present on the calls where decisions are actually made—that deeper understanding doesn’t automatically translate into better decisions for the organization.

This is because executives already have another way of assessing risk. They have their intuition.

Many experienced leaders maintain a natural understanding of their operating environment and the risks they face. Their job is to know where their organization is strong, where it is exposed, what keeps going wrong, what has changed recently, and what concerns them.

That isn’t to say their intuition reflects the “best” information available. Their understanding may be incomplete, biased by personal experience or beliefs, or overly influenced by recent events. But it has one enormous advantage over a formal risk assessment: it is available immediately and all the time.

So any documented assessment has to compete with it. If finding the assessment takes too long, if interpreting it requires outside help, or if the executive questions whether the information is still current, then there is a good chance they bypass a review of the formal assessment and just make the decision using the understanding already in their head.

That puts a different standard on the assessment. If its purpose is to help people make better risk-informed decisions, then I think a few things have to be true.

It needs to be accessible.

When someone is making a risk-oriented decision, they should be able to quickly check the assessment and understand how the issue they are considering fits within the organization’s larger risk picture.

That means they need to know the assessment exists, where to find it, and get to the relevant information without needing an analyst to walk them through it. The more friction involved in finding the information, the less likely it is to be used when decisions are made.

It needs to be current.

Even if an executive can find the information quickly, they still have to trust that what they are looking at reflects today’s reality.

An assessment that accurately describes an organization’s risk two years ago may still contain useful information, but risk changes all of the time. New information and research becomes available, threats and hazards evolve, the operating environment shifts, and organizations gain and lose capabilities every time a person joins or leaves the organization.

So updating the assessment has to be easy too. Adding new information and data, and recalculating its effect on risk can’t require restarting the entire process. The goal is to provide a living understanding of risk that can change as the environment changes.

It needs to be fast.

There is also a problem of how long it takes to create a risk assessment. If you think about a hazard mitigation planning process, the goal is to determine which mitigation projects will have the greatest impact and where a community can invest their limited funding and resources.

Yet before getting to those decisions, they might spend months assessing or reassessing their risk. Some of that work to collect good information, validate it, and apply it will take time, but every week spent getting to a usable understanding of risk is another week before the organization can begin deciding what to do about it.

And sometimes you don’t have months. If a leader asks how a newly identified threat compares to existing priorities, whether a proposed investment addresses a significant risk, or what has changed since the last assessment, the answer can not take months to produce. It has to be answered while the decision is being made.

Finally, it needs to be relevant to the decision being made.

This might be the most important test and probably the question I’d start with. Before beginning a risk assessment, we should be able to answer a fairly simple question: What decisions are we trying to make better?

The answer should shape the assessment itself—what gets included, how deep and far you go with the analysis, and what the decision-maker actually needs to see presented.

There will always be more that could be researched. There is always another data source, another scenario or angle to explore, another vulnerability, and another layer of analysis that could be added. But at some point, that process needs to stop and the information has to reach the person making the decision in a form they can actually use.

The judgment required to know when to stop can only come from knowing what decision is being made.

That brings me back to the question I started with: What makes a risk assessment good?

Comprehensiveness, accuracy, methodology, and the quality of the underlying research are all important, but those elements are secondary to making better decisions. The outputs of this process should show up in the quality and intentionality of where an organization invests its time and money.

A good risk assessment should reduce the friction and time required to develop an assessment because that friction and time carry a cost. Every additional week spent researching, analyzing, documenting, or updating a previous risk assessment delays the moment when an organization or a leader can recognize a priority, choose between competing investments, identify where additional capability is needed, or decide where limited time and resources should go.

The less friction there is between understanding the risk and making those decisions, the more valuable the assessment becomes and the sooner an organization can get to the work of actually doing something about the risk it identified.

As we close out this essay, I’m curious where the most amount of friction shows up in your organization’s risk assessment process—developing it, keeping it current, or actually using it. If you’re open to it, hit reply and let me know.

Fifteen years ago this month—in August 2011—I wrote the first article that eventually became The CP Journal.

At the time, we had just received an offer to write Left of Bang, and I realized that if the book was going to have any chance of succeeding, I needed to become a better writer. And after reflecting on some early article drafts, I recognized that I needed to become a better thinker.

Looking back today, those early articles make me cringe as often as they make me smile. They were rough and often lacked the clarity that comes with experience writing and teaching the concepts. But they also taught me a lesson that has shaped every article we’ve published since then.

Those early articles are the reason why we call this platform The CP Journal.

The “CP” is a nod to our origins. While Left of Bang tells the story of the Marine Corps’ Combat Hunter Program, much of the book focuses on Combat Profiling—the ability to observe human behavior, establish baselines, recognize anomalies, make decisions, and act before a threat materializes.

Although our work has expanded beyond those original topics, our founding principle to make the concepts available and accessible to anyone who is interested in learning how to get ahead of events hasn’t changed. Whether someone is deploying overseas, responding to a wildfire, managing an emergency operations center, protecting a business, or leading a public safety organization, the people who volunteer to protect others deserve immediate access to the ideas that can help them make better decisions before a crisis unfolds.

To this day, the “CP” provides the only reminder we need about who we exist to serve and what is at stake. The “Journal” portion of our name, however, sometimes raises a different question.

No, it wasn’t chosen because we wanted to sound like a newspaper or an academic publication. We chose “journal” because it best describes how we think about writing.

For me, writing is part of the process of learning. It isn’t the final step, but part of the process for me to translate disconnected observations into a coherent idea. It allows me to find gaps in my understanding of a topic that weren’t obvious before the first sentence was written and it exposes assumptions that don’t hold up the scrutiny of real world application. More often than not, I start writing because I’m trying to figure out what the problem I’m trying to solve or articulate a potential solution to it.

Publishing ideas that are still evolving has been a foundational principle since that first blog post. Once I realized that writing was how I improved my thinking, I realized that readers shouldn’t only see the finished product, but should also benefit from the thinking while it was evolving.

We would rather share our best current understanding of an important problem today than wait years to publish a version that appears more complete, but is too late to actually help people.

Sometimes that means an article is Version 1. Sometimes it’s Version 2. Sometimes we realize we were wrong and need to rethink the problem entirely.

One of our most-read essays, The Evolution of Left of Bang, has been revised multiple times over the years. We haven’t changed it because it was “wrong,” but because the clients and professionals we are working with have taught us something new. Those experiences changed our understanding of the framework, and the article changed with it.

This isn’t just about how we write though. The question, at least to me is, what does that mean for you as a subscriber?

It means that you’ll see ideas develop over time instead of being presented as immutable doctrine. It means that every article is written with the same question in mind: Will this help someone make a better decision before a crisis, disruption, or opportunity presents itself?

That’s the standard we try to hold ourselves to. Sometimes we hit it. Sometimes we don’t. And we don’t promise a perfect writing process or promise that our methods, tools, or approach will never change.

But what we do promise is that every article represents our best current understanding of problems that are important to professionals working to get left of bang.

Even though what we write about has changed in the past fifteen years, we’ve remained remarkably consistent to that mission.

We’re still learning, refining, and writing, but that is what The CP Journal means to me. We’re still doing that for the people who raise their hand and accept the responsibility of protecting others.

If you’ve been with us since the beginning, thank you for that support. It means more to us than you know. If you’re new to The CP Journal, thanks for joining us on this journey.

For the past fifteen years, The CP Journal has been our public journal of learning and we hope it continues to help you get left of bang for the next fifteen.

—Patrick

While you're here

We released a new episode of Baselines & Anomalies this week examining what July's flood of incidents teaches us about organizational readiness and decision-making under uncertainty. Watch or listen here, and enable notifications in your profile if you'd like future episodes sent directly to your inbox.

This episode is part of Baselines & Anomalies, a video series from The CP Journal that examines events through the left of bang framework.

Episode Summary

The middle of July brought a relentless stream of floods, wildfires, extreme heat, power grid concerns, tropical weather, public health alerts, and international disruptions. While few organizations were directly affected by every incident, nearly every public safety, security, or resilience professional was forced to evaluate whether those events posed a threat to their organization or community.

This episode argues that periods of concurrent disruption are more than busy news cycles—they are real-world stress tests for an organization’s assessment capability. By examining how your team recognized, assessed, and prioritized this wave of incidents, you can identify whether your assessment process enables proactive decision-making or has become the bottleneck that limits your ability to stay left of bang.

Read more

Welcome back to The CP Journal, where we break down what it takes to get left of bang.

We talk a lot about situational awareness in our articles and with our clients, but I don’t know if I’ve written much about the hidden cost that emerges once people begin using it in their organizations to become more proactive.

Situational awareness comes with its own set of terms and conditions that you accept when you set out to get left of bang. The problem is, just like the T&C box we blindly accept when using a software platform, we rarely read it or understand the tradeoffs before we take the first step.

When it comes to awareness, what you are agreeing to is this: once you start to see some things, you start seeing a lot of things. Situational awareness is like turning on the lights in a dark room. When that happens, you see the whole room, not just the thing you were looking for.

You can’t necessarily control or limit or contain where that awareness gets directed. So you see the good and the bad. You see things that are pleasant, and you see things that aren’t. And it changes something in you because once you see reality clearly, you lose the ability to pretend you didn’t.

This is the hidden cost of situational awareness.

Once that awareness exists, the responsibility to act also presents itself since you can no longer honestly say, “I didn’t know,” or “nobody could have predicted this,” or “we never saw it coming.” While I think this is easy to accept in theory and when the risks are abstract, I have routinely seen the impacts of this reality on organizations and their leaders the moment a risk becomes something real and tangible.

The difference between an individual improving their situational awareness and an organization doing the same is how public the decision-making process is. When an individual observes human behavior, establishes a baseline, identifies anomalies, assesses the threat level, makes a decision, and acts, the entire decision-making process occurs in their head. An external observer is limited to whatever explanation that person gives to justify their action, or lack of action, in a situation.

But in an organization, the entire recognize→assess→decide→act process is visible. There are emails, messages, debates around conference tables or video meetings, and there is a record—at least with those present—of what decision was or wasn’t made.

Without awareness of your surroundings or environment, that process never happens because nothing ever triggered the conversation about a potential threat, hazard, or opportunity. Yet with awareness, it happens routinely.

When I said at the top of the essay that situational awareness costs a person the ability to say, “we never saw it coming,” this is what I mean. Once a conversation about a potential threat happens, there is a record that you were in fact aware and that you made a decision about what to do about it.

So, what decisions do organizations make? In my experience, I’ve found that there are four general ways that people respond to being presented with challenging and uncomfortable issues in their organizations.

First, there are those that simply opt out. They recognize the cost of situational awareness and shut down the program, essentially choosing to revert back to how they were operating before they were aware because they don’t believe the cost of awareness is worth the reward. Whether this is the right or wrong way to deal with the challenge is beside the point—many organizations choose to not see what is happening.

Second, there are those who manifest the organizational equivalent of the “freeze” response to a new stress or threat. They don’t explicitly opt out, because that decision carries its own risk, but they avoid making any meaningful decisions once they become aware of a problem. They might rationalize away any perceived risks. They may postpone a decision by requesting more information or data in the pursuit of certainty. They may defer a decision until the next budget cycle in an attempt to buy themselves time before actually making a choice about how to respond.

Third, there are those that become incredibly busy. In response to an unanticipated problem they just discovered, people and teams start moving a thousand miles an hour, frantically trying to address everything all at once. But there are no real priorities, and whether those actions are the right ones is a different story. There is an odd form of career safety in activity. Being busy can feel safer and easier to justify than actually prioritizing what would be the best use of their time.

And fourth, you have the leaders who recognize the environment for what it is, understand that they are going to have to make some decisions—often some very tough ones—and act based on what they understand now. This path is admittedly reserved for only those who can accept their reality, and even though they can’t change the past or redo the decisions that got them into this position, they recognize they can control what they do going forward.

To be clear, I don’t envy the leaders in this situation. Sometimes clients become friends through a project, and I often find myself wishing that they didn’t have to do the hard thing. I recognize that what they thought they would do in the job, or what they wanted to do in the job, needs to get put aside so they can focus on what has to be done.

They might need to upset some external partners or members of their own team. They might need to re-allocate their limited budget, tell people no, accept short-term political pain, change priorities, and admit that previous assumptions might have been wrong. Even when those decisions are necessary, it doesn’t mean they are particularly fun or enjoyable or easy.

But at the same time, it’s what their organization, or their community, requires of them. It’s what their role as an executive and leader demands of them. It’s where they have to decide whether they are the ones to continue leading the organization—whether they have the resolve and willingness to lead that transformation—or whether they need to step aside so someone with the energy to drive this change can take the helm.

That’s why it is important to acknowledge the cost that situational awareness carries from the onset. The better you and your organization become at seeing emerging problems, the more uncomfortable truths you will encounter. In other words, better observations only increase the frequency of difficult decisions.

But with each early recognition of an emerging problem and each tough decision that follows, organizations gain the ability to get ahead of it, shape their environment, position themselves, and be well-prepared whenever it happens. To me, that’s the test. It is what happens after awareness has been achieved that makes situational awareness valuable.

Before You Go

Know someone responsible for helping an organization prepare for uncertainty? Share this newsletter with them.

Go deeper with a paid subscription for advanced courses, playbooks, and full podcast episodes.

Ready to strengthen your organization’s readiness? Active Analysis Consulting helps organizations improve decision-making, operational capability, and preparedness.

I had a commander in the Marines who taught what he called his “gear theory” of leadership.

His idea was simple. Every person in an organization is a gear and their role determines the size of their gear. The commander at the top of the org chart is a very large gear and turns relatively slowly.

Each level below him on the organizational chart is a smaller gear, which has to spin progressively faster just to keep pace with him. By the time you reach the most junior Marine in the unit, that gear is spinning at a sprint—even if the commander doesn’t feel like he’s moving particularly fast.

Even though people will adapt to almost any baseline operating tempo in time, his lesson was about what happens when the commander changes how fast his gear turns.

Every time a leader suddenly accelerates, every gear beneath them has to accelerate even more to keep pace. A small increase at the top becomes a much larger increase at the bottom of the organization and it creates this pattern of sudden spikes in the work and effort of the organization.

As a leader, if you do that often enough or do it without warning, eventually the gears in the organization begin to break as they are unable to keep up. The people represented by those gears make mistakes or choose to disconnect from the system altogether, counteracting many of the gains the organization has made.

His point was, even though you can’t always prevent that spike in work from happening, as a leader, you need to be aware of it and understand the impacts that sudden changes in pace have on a team.

I’ve thought about that lesson many times over the years, but it’s been coming to mind more and more often recently. The environment we work in is becoming increasingly more demanding. Every week seems to bring another new vulnerability, another threat to evaluate, another new technology to understand, and another expectation to meet.

What this means—in practice—is that organizations are not only experiencing a higher baseline operating tempo, but also a non-stop set of spikes in work. This is taking a toll on the people leading these organizations and the organization’s ability to prepare for an uncertain future.

Here’s my premise for this essay: as the pace of required adaptation increases, the ability to absorb change and adapt to new threats and hazards will be what separates organizations that emerge stronger from those that break.

Doing that requires organizations to build three distinct capabilities to keep the organization’s gears spinning at pace that both matches the demands of the environment and is sustainable to continue changing in the future as well.

Let’s get into what those are.

The Three Capabilities

Every time an organization successfully adapts to a new threat, vulnerability, or expectation, it completes the same basic cycle.

• First, someone has to recognize that a gap or vulnerability exists.

• Second, someone has to develop a solution that addresses the issue.

• Third, that solution has to spread throughout the organization and be adopted by people who were never involved in identifying the problem or developing the solution.

Those three steps sound almost too simple to write down, yet organizations routinely face the consequences of failing to complete the cycle.

• When a vulnerability isn’t recognized, organizations continue operating as if nothing has changed and with a false sense of security.

• When a solution can’t be developed, organizations are left with open vulnerabilities to known problems.

• When a solution is never implemented, the organization has done little more than build a good idea that sits on the shelf.

Regardless of which capability isn’t functioning, any failure to complete these three steps creates the same outcome: the organization remains exposed.

So, for leaders focused on moving their organizations further left of bang, recognizing which of these three capabilities is limiting adaptation in their organization becomes one of the most important questions they can ask.

You can see this cycle in cybersecurity.

While recording this week’s episode of Baselines & Anomalies, I looked at CISA’s directive to shorten the time federal agencies have to address high-priority vulnerabilities. Agencies that once had two or three weeks to deploy a patch now only have three days.

Someone has already identified the vulnerability, and the technical problem has already been solved with a patch. And then the race begins.

Can the update reach thousands of devices before attackers exploit the vulnerability? Recognition and solutions matter, but in this case, implementation determines whether the organization actually becomes more secure.

You can see this cycle in physical security.

In last week’s briefing, we shared an article describing Boko Haram’s use of AI tools to modify motorcycles so fighters could jump over defensive trenches that had stopped them during an earlier attack in Nigeria.

Whether those efforts were identified through intelligence or first became known after the reporting doesn’t really change what comes next. The organization responsible for defending against that threat must recognize what changed, determine how to respond, and ensure every location adopts the new defensive measures before the next attack occurs.

Any delay in developing the solution leaves the vulnerability open.

There are countless more examples we could analyze, and even though the names, threats, and environments all change, the cycle doesn’t.

Building Organizations That Can Keep Up

While understanding this cycle is relatively easy, building an organization that can complete it over and over again is where leadership becomes critical.

In my experience, I’ve found that different people gravitate toward different parts of this process. Some people are naturally skilled or interested in recognizing emerging problems, others know how to build solutions, while others have learned how to communicate, organize, and drive implementation across a large system.

But organizations only become more ready and more resilient when all three capabilities work together. Strength in one area can never compensate for weakness in another.

• Recognition without solutions changes nothing.

• Solutions without implementation accomplishes nothing.

• And the ability to implement without the ability to recognize gaps produces nothing.

Ensuring that all functions can perform—and perform well together—is where leadership comes in. Building the ability to do this is rarely automatic, so leaders need to choose where to invest their time, money, and effort to ensure their organization can do all three.

Since each function depends on the same foundation, the process to determine the greatest need can be done consistently. You need people with the right skills, plans and processes that ensure effort is applied productively, sufficient resources, and regular validation that everything works before it’s needed.

These investments often feel expensive because they are made before anyone knows exactly when they’ll be tested, but they determine whether the next identified gap becomes a manageable adjustment or another organizational fire drill.

My point is that leaders can’t control how quickly the environment changes, but they can control whether their organizations are prepared to adapt when it does. And increasingly, that may be the difference between organizations that simply survive change and those that emerge stronger because of it.

Before You Go

Know someone responsible for helping an organization prepare for uncertainty? Share this newsletter with them.

Go deeper with a paid subscription for advanced courses, playbooks, and full podcast episodes.

Ready to strengthen your organization’s readiness? Active Analysis Consulting helps organizations improve decision-making, operational capability, and preparedness.

This episode is part of Baselines & Anomalies, a video series from The CP Journal that examines events through the left of bang framework.

Episode Summary

Artificial intelligence is changing more than the tools available to defenders and attackers—it is changing the speed at which organizations are expected to adapt. In this episode, we examine CISA’s decision to reduce the time federal agencies have to patch critical cybersecurity vulnerabilities from roughly three weeks to just three days and explore why that policy change matters far beyond cybersecurity.

Rather than focusing on patch management itself, this episode uses the directive as a case study to examine a broader leadership challenge: how organizations respond when performance expectations suddenly change. As adversaries become faster and more capable, leaders must understand which capabilities need to evolve—and how to adapt their plans, people, resources, skills, and validation processes to meet a changing environment.

Read more

Hey everyone,

Over the past couple of weeks, I had the opportunity to revisit and update some of the foundational pages on The CP Journal.

Admittedly, these are pages that most readers don’t notice all that often. But the pages that explain what the company is, where we came from, and how to get the most out of the site serve a critical role as the connective tissue across all of the articles we’ve written.

When these pages do their job well, they help new readers get oriented, allow existing subscribers to discover resources they may have missed, and make the site a little easier to navigate. Because of that, I like to come to these pages from time to time to make sure they are doing their job.

As I worked through those updates, I could see where my thinking has remained consistent since our first blog post was published in 2011, but also where it has evolved as the threats, hazards, and operating environment in which our readers and clients work have changed. Just as importantly, I could see how we’ve continued to refine how we package and deliver those ideas so they’re easier to apply in the real world.

That backward-looking perspective was helpful as we quietly launched the next version of how we will share our concepts this past week.

Our new podcast, Baselines & Anomalies, is another way we will explore these ideas. Some stories work better in conversation than they do as essays, and the podcast format will give us room to work through current events and what they reveal about the changing environments we work in.

We’ll share more about it over the next few weeks once we’ve built up a small library of episodes, but if you’d like an early look, our first episode goes into Europe’s wildfire readiness challenge and the importance of defining readiness problems accurately.

There is still plenty more to build, but every step brings us closer to helping more people recognize change earlier, make better decisions, and prepare with greater confidence.

Four Things We Read This Week

Here are some articles we read this week that can shape how you’re getting left of bang.

How Terrorist Groups are Using A.I. to Gain an Edge in Battle

Here’s the hook: members of Boko Haram are using A.I. to learn how to jump motorcycles over trenches (how they were stopped in a past attack). They then practice by having members actually jump motorcycles over trenches filled with fire and broken glass as an incentive to not fail (not everyone makes it).

Why we’re sharing it: A lot of conversation about A.I. and security has centered on cybersecurity or the use of A.I. for misinformation/cognitive warfare. The research this article is based on is one of the first that shows how terrorist groups are using it to improve their capabilities and conduct their mission planning.

You can read the article here.

3 Factors Determine if a Strait Becomes a Flashpoint

I absolutely loved this deep dive from the “People’s Art of War” that breaks down what makes a great naval chokepoint. “The world’s trade runs through a handful of gaps narrow enough to see across…Those who control the chokepoints, control the world.”

But how do you determine which ones matter?

The bypass cost is one factor. Who is nearby is a second. How replaceable the things on a stopped ship are is a third. After explaining each of those elements, the article then goes on to identify 5 critical straits not named Hormuz.

You can read the article here.

The Problem of Unlimited Hindsight

Every after-action review faces the same problem: once you know how an event ends, it’s almost impossible to put yourself back into the uncertainty that existed beforehand.

In this article, Von Kliem, President of Force Science, examines the prosecution of a Hartford, CT police officer and the broader debate over accountability, de-escalation, and hindsight in use-of-force investigations. What I found interesting (amongst other things) was the discussion on hindsight.

The challenge when evaluating an incident—whether it is a police use of force or a hurricane—is to only consider the information available to the person or organization at the time of the incident and what preceded it. Perception of a threat, for example, can’t be objectively assessed if it includes information that only revealed itself after the incident occurred.

This is critical for determining what was reasonable before an event—while left of bang—since certainty only becomes possible after the fact—once right of bang. If your role involves taking action without certainty, this article is worth the read as you shape organizational policy and expectations.

You can read the article here.

The Builders Creed

One of the themes we come back to often is that getting left of bang isn’t just about recognizing threats—it’s about intentionally building better organizations before those threats arrive. The future is not something that happens to us—it is something we make.

In this article, Seth Godin outlines 32 rules, concepts, and promises for actually building something, not just talking about it. This article provides an excellent set of reminders for anyone building a better organization, a safer community, or their personal skill set.

You can read the article here.

Before You Go

Know someone responsible for helping an organization prepare for uncertainty? Share this newsletter with them.

Go deeper with a paid subscription for advanced courses, playbooks, and full podcast episodes.

Ready to strengthen your organization’s readiness? Active Analysis Consulting helps organizations improve decision-making, operational capability, and preparedness.

This episode is part of Baselines & Anomalies, a video series from The CP Journal that examines events through the left of bang framework.

Episode Summary

Europe’s firefighters are warning that they are underfunded, understaffed, and unprepared for another severe wildfire season. But while the article we discuss frames these challenges as a readiness problem, it also highlights a broader leadership issue: organizations often use the same word to describe fundamentally different problems.

In this episode, we examine why defining the problem is the first step toward building organizational readiness, and how separating hazards, mitigation, capabilities, and resources leads to better decisions and better investments.

Read more

This episode is part of Baselines & Anomalies, a video series from The CP Journal that examines events through the left of bang framework.

Transcript

• Hey everyone—I’m Patrick Van Horne, co-founder of The CP Journal, and today, we are launching something new for our subscribers.

• Every day, leaders are expected to stay on top of what’s happening around the world, identify what’s relevant to their organization, and implement improvements before they’re needed.

• We recognize that it’s easier said than done.

• Every morning you wake up to an avalanche of emails, news, commentary, and analysis. Trying to sort through it all, determine what’s actually important, and figure out what you should do about it is a big ask.

• It isn’t always as simple as reading the article or the AI-generated summary.

• So today, we’re launching a new podcast series that looks at current and past events through the Left of Bang lens.

• In each episode, we’ll break down incidents, case studies, and stories from around the world and help leaders understand what happened, why it matters, and what lessons they can apply in their own organizations.

• We’ll examine events from strategic, operational, and tactical perspectives, and we’ll also speak with the leaders, the operators, and the practitioners who are addressing these challenges head-on in their organizations.

• We’re calling the series Baselines & Anomalies because the goal is to help you understand what’s normal, recognize what’s changing, and think through how those changes might impact you.

• I certainly hope you’ll join us.

• The first episode is available now, and we’ll be releasing new episodes throughout the year.

• Thanks for watching, and I look forward to helping you and your organization get Left of Bang.