What we do
Know what you'd lose. Fix it. Prove it. Keep proving it.
Resilience is not a document. It is a number you measured in a rehearsal, before the real bad day. These are our four jobs, in the order they pay off.
Know
What would stopping cost, and how fast must you restart?
Almost everywhere, recovery targets were set by IT from what the systems can do, not by the business from what it can bear. That is backwards, and it is why the first real incident breaks the plan.
- 1 to 2 weeksInterviews and discoveryLeadership, IT, operations, suppliers
- 1 weekAnalysisComparison to frameworks and your targets
- Half a dayReadoutFindings and roadmap for leadership
Business impact analysis
Interviews with the people who run the services, not only those who own the servers. Output: how long each service can stop before the damage is unacceptable.
Dependency and third-party map
The outage that hurts almost always comes from a dependency nobody listed: an identity provider, a payment processor, a single cloud region, a security tool installed everywhere.
RTO and RPO targets
Signed off by the business owner, with the cost of meeting them next to the cost of missing them.
What you get
- Findings report and maturity score
- Register of essential services and dependencies
- RTO and RPO targets signed off by leadership
- Prioritized roadmap and executive readout
Prepare
Recovery built for a bad day, not a good one.
A backup is a copy. Recovery is a capability. Most organizations own the first and assume the second.
Recovery architecture and runbooks
Step-by-step runbooks, written with the people who will run them and timed against the recovery target. A runbook only its author can follow is not a runbook.
Backups that survive an attack
Isolated or immutable copies, separate administration accounts, and a restore actually performed by someone other than the person who set it up.
Identity and remote access
Multi-factor authentication wherever anything is exposed, inactive accounts removed, password resets verified. It is the way in for several of the incidents studied on this site.
Cloud and vendor concentration
One region, one provider, one control plane: what do you do when the status page is red? We look for single points of failure and propose fixes proportionate to the risk.
Continuity and crisis plans
Short, current, usable under pressure, and written with your teams. They cover people, sites, suppliers and communication, not only IT.
What you get
- Recovery strategy and architecture, step-by-step runbooks
- List of single points of failure, ranked by risk
- Incident response plan and playbooks
- Continuity and crisis management plans, communication templates
Prove
What you haven't rehearsed, you have only hoped.
The first test almost always fails. That is its value: every blocker found in a rehearsal is one you will not discover during the incident.
Tabletop exercises
Leadership and teams facing a realistic scenario from your sector, with a decision log. You find out who decides, who does not answer, and what nobody planned for.
Technical restore and failover tests
Timed against the target, using the documentation as it exists today. Including the loss of a region, not only a server.
Crisis simulations
Communication under pressure, out of band: what you tell staff, customers and the media when your usual tools are unreachable.
What you get
- Scenario and exercise pack
- After-action report
- Prioritized remediation plan
Stay ready
Resilience decays. Plan for the decay.
Environments change faster than plans. A plan older than a year describes a company that no longer exists.
Quarterly resilience review
What changed, what broke in testing, what is still open. A risk and action dashboard leadership actually reads.
Regulatory readiness
DORA, NIS2, FCA/PRA, OSFI, SOC 2: evidence rather than documents, and support for audits and customer questionnaires.
AI agents: re-audit on every change
A model, prompt or permission change moves the blast radius. FZ AI Auditor re-runs the measurement on every material change.
What you get
- Quarterly resilience review
- Risk and action dashboard
- Support for audits and customer questionnaires
Start on your own
How we work
Independent, by design. We resell no software or hardware, and we work on the platforms you have already chosen. Every recommendation starts from your needs, not a vendor's catalogue. In French or English, remote or on site.
Go further
Frequently asked questions
Where should we start?
Usually with an assessment, which sets your priorities and a roadmap. A 30-minute intro call helps confirm whether that is the right starting point.
How are you different from a reseller or integrator?
We sell no software or hardware. Our income does not depend on the products we recommend, which keeps our advice independent.
Aren't our backups enough?
Backups are necessary but not sufficient. You also need to know the restore order, how long it really takes, and that the copies have not been compromised.
Isn't being in the cloud already disaster recovery?
Not automatically. The provider protects its infrastructure, but your data, configuration and access remain your responsibility.
Do you run penetration tests?
We can scope the test, help select a specialist provider, and help you interpret and fix the findings.
Can exercises be run remotely?
Yes. Tabletop exercises work very well over video, which makes it easy to include teams across several countries.
Do you provide legal advice on compliance?
No. We provide operational and technical advice and are happy to work alongside your legal advisers.