Polycrisis planning in-a-box
A heatwave, a supplier failure and a cyber attack in the same month. Which of your services stops first?
Most leadership teams will tell you they have a continuity plan. Ask what happens if a heatwave, a supplier failure and a cyber attack land in the same month, and the room goes quiet.
That quiet is the gap. Most plans are written for one failure at a time: the server outage, the flood, the strike. They assume the rest of the world keeps working while you recover. A plan for one failure may not survive three.
At Pineapple we start from a simple belief: the problems that matter most are too big for any one organisation, and the answers come from the partnerships between them. We have just completed a pilot with a large corporate, testing how its most important services depend on a wider web of suppliers and partners.
This post sets out what we learned, and the approach we now offer other leadership teams for business and operational resilience, which we call 'polycrisis planning in-a-box'. By polycrisis we mean the understanding that the world now faces multiple crises at the same time: climate, nature, war, cyber attacks and more.
You can learn more about our offer and our collaborators at our upcoming roundtable on Monday 30th November and through completing our very quick Resilience Health Check, so you can see where you stand before diving in.
Pressures now arrive together
Extreme weather, cost shocks, cyber incidents and people shortages are each familiar. What has changed, we think, is that they overlap, and one often removes the alternative you were counting on to cope with another.
Take a realistic month. A heatwave takes out your main supplier. Your backup would step in, but a cyber attack has just taken it offline. Each risk may have its own plan, yet customers still go unserved, because each plan assumed the other fallbacks would hold.
Cost volatility is often what puts continuity on the leadership agenda, and it is a good moment to widen the question. A plan written for one failure at a time can break when two or three arrive together.
Start with what you must keep doing
We start with your own organisation, not your suppliers. Which five or six chains of activity must keep running? For many organisations they cover serving customers, delivering the product or service, getting paid and paying others, protecting data and trust, and looking after people, though yours will differ.
For each chain, agree what "stopped" looks like and how long you can tolerate it. That tolerance becomes the yardstick for everything that follows.
It also ties the work to purpose rather than cost. Judge each dependency by the activity it protects, not by what you pay for it.
Map what each chain rests on
Every chain rests on systems, sites, utilities, suppliers and partners, and people, and the exposure sits in the combinations. In our pilot, one customer-facing service depended on four separate suppliers working together. A chain that needs four things at once is not restored when three come back.
The next question is what your separate options have in common: the same platform, the same place, the same person. In the pilot, a reported backup site sat in the same block as the main site. A backup only counts if it survives the same event as the thing it backs up.
Then look inside, because your own organisation is part of the recovery chain.
Every chain needs a named owner and a deputy with the authority to act. The contacts, access details and workarounds people rely on should sit in one centralised place where others can find them. And your decision-makers should not all be exposed to the same storm.
No organisation can solve this alone
Your continuity sits partly in other people's hands, and theirs partly in yours. That interdependence is what Pineapple was built around. It is what we mean by the Partnership Era, and our work across value chains for system-wide impact begins from the view that no single organisation can deliver it alone.
Continuity is not a private exercise. It is about relationships. So we treat your value chain as one partnership, with your organisation, suppliers and customers around one table, and build one shared picture of who depends on whom. Then we test it together through joint scenarios, with one evidence request in place of many separate ones.
Convening value chains is a core part of what Pineapple does as a think tank, consultancy and venture builder. We have convened consortia of complementary businesses before, and the same skills apply here. Each organisation stays accountable for its own services; what changes is that the picture and the plan are shared.
Plan across three horizons, and be honest about what you find
Many continuity plans stop at Horizon 1, which is keeping today's activities running. We add two more.
Horizon 2 is strengthening what you share with your value chain, so that your alternatives survive compound disruption because they were built with the people who share them.
Horizon 3 is adapting what you do: rethinking what you offer and how you deliver it, as customer needs, technology and access change.
Our pilot assessed 21 suppliers behind six critical services and traced nine chains of dependency. It informed Horizons 1 and 2, and it sparked a conversation about the future.
The findings were measured. No immediate crisis was identified, but complete service recovery has not been demonstrated. The scores show exposure and evidence gaps, not predictions of failure; they tell you where to look first. We have not put a value on the benefits, and we would rather say so than guess.
Start with a health check
Before any of this, you can see where you stand. Our Resilience Health Check is free, takes about five minutes and is confidential. It has 18 questions in six parts: what must keep running, then four pressures that tend to arrive together (nature, money, technology and people), then buildings and energy, an area central to Pineapple's work. For each question you say whether something is in place and whether it has been tested.
The results rank the six areas and suggest a first move for each. As in our pilot, they show exposure and evidence gaps, not predictions of failure.
A check like this covers only your own organisation, and resilience only works when organisations work together. If you would like to talk through your results, we offer a 20-minute debrief with the Pineapple team, and we can help you bring your suppliers and customers into the conversation.
What's in the box, and where it starts
We do the work and you keep the capability. First we agree with your leaders what matters most, which gives you a baseline of chains and tolerances. Then we bring your value chain together to map dependencies, so that you end up with one shared dependency map.
Next we check your plans against what you can tolerate and rank the exposures, with the evidence gaps beside them. We stress-test two or three failures with your value chain, and you own the findings jointly. Finally we look across the three horizons with your leadership to decide what to fix, strengthen and explore, and hand over ownership: named owners, deputies and a 30/90-day plan.
The full programme starts with one conversation with your leadership team about the five or six chains that matter most, and the suppliers and customers behind them. We bring them to the table, as we do in all our partnership work, for people, planet and purpose.
What's next?
Take the health check at https://www.pineapplepartnerships.com/resilience-check. If you would like to talk through your results in a 20-minute debrief, get in touch at rafi@pineapplepartnerships.com.
Sign up to our roundtable, Monday November 30th, here: https://luma.com/fmbgr3hx
Rafi Addlestone, Chief Strategy Officer, Pineapple Partnerships
