037 - When Incident Response Plans Meet Reality

It’s a new year, which means it’s time for every SysAdmin’s favorite activity...... dusting off the incident response and disaster recovery plans that haven’t been touched since the Apollo moon landing.In this episode of SysAdmin Weekly, Andy and Eric dig into why incident response, disaster recovery, and business continuity plans so often exist… but completely fall apart when something actually goes wrong. They talk through what makes a response plan useful versus useless, why roles and decision-making matter more than tools, and how slow human processes can undo even the fastest detection systems.The conversation spans real-world tabletop exercises, ransomware scenarios, MFA bombing, on-call failures, and the uncomfortable reality that many organizations still don’t empower anyone to make business-impacting decisions during an incident. Eric even shares fresh lessons learned from a recent tabletop exercise, including what happens when critical people are unavailable, how communication can fail under pressure, and why “solo warrior” response patterns collapse fast.Along the way, Andy and Eric also touch on Broadcom’s ongoing VMware licensing chaos, cease-and-desist letters, the continued enshittification of enterprise software, and why supply-chain dependency should make every IT pro a little nervous.If you’ve ever wondered whether your incident response plan would actually survive first contact with reality or if you’ve never tested one at all this episode is your wake-up call.### Episode Resources- New SysAdmin Weekly GitHub Discussion Boards! - https://www.github.com/ProjectRunspace/sysadmin-weekly- SysAdmin Weekly Companion Newsletter - https://newsletter.sysadminweekly.com- SysAdmin Weekly Website - https://www.sysadminweekly.com- AndyOnTech - https://www.andyontech.com- Project Runspace - https://www.projectrunspace.org- Bastard Operator From Hell - https://bofh.bjash.com- Continued VMware / Broadcom Drama - https://www.reddit.com/r/sysadmin/comments/1pzp3eo/vmware_now_threatening_outages_to_perpetual/- SysAdmin Weekly - 029 - When Good Tech Goes Corporate - https://open.spotify.com/episode/6tDkgEmzjJQgmBSxCRcDeR?si=31S2s8ATTCuRnach82MUHw- WMI Documentation - https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page