Louis Zezeran
22. okt 2026
Your Security Plan Is Just Hope Until Someone Tests It
Ask most companies whether they’re prepared for a cyber attack and you’ll get a confident yes. They have firewalls. They have an IT partner. They have a security plan sitting in a shared folder somewhere. Now ask a harder question: when did you last test that plan? When did you last restore a backup? Who owns the access list for the software your warehouse runs on?
That’s where the confidence usually ends, and that’s where this episode begins.
Recorded live on the floor of the Nordic Baltic Security Summit in Tallinn, this edition of the NEVERHACK Cybercast takes a deliberate step sideways from the usual threat-intelligence conversation. Host Ronnie Jaanhold sits down with Aleksandr Miina, co-founder and partner at Lean Digital, a Tallinn consultancy that helps companies optimise and digitalise their business processes. Aleksandr isn’t a threat researcher. He’s spent around 20 years inside manufacturing, logistics and engineering companies, and his doctoral research at TalTech looks at why Lean implementations succeed or fail in Estonian manufacturing. In other words, he studies why good ideas die inside real organisations.
The episode title says it all: Hope Eats Strategy for Lunch. Cybersecurity, Aleksandr argues, rarely fails because of missing technology. It fails because of missing discipline.
The Tech Is There. The Management Layer Isn’t.
Ronnie opens by acknowledging the obvious tension: security people are not process people, and many of them actively dislike process. So why is a Lean consultant talking about cyber?
Aleksandr’s answer comes from two decades of looking inside companies. When his team turns to cybersecurity questions, the technical layer is usually in place: tools, firewalls, the things that get bought. What’s missing is the management layer. Is there a list of all the software the company uses? Does each system have a named owner? Are there rules for granting access? When someone joins, is their access written down anywhere, so it can be removed when they leave?
These are unglamorous questions, but they address what Aleksandr calls the biggest risk in cybersecurity: people. And in his experience, they are very often unanswered.
He gives a vivid example from manufacturing. Walk into a warehouse and you’ll frequently find a PC that’s always logged in, with a single shared username and password that everyone uses. Any truck driver, or anyone else who walks in, can plug in a USB stick. No firewall in the world fixes that.
A Plan Is Not a Process
This is the core idea of the episode, and it’s worth slowing down for. Many companies tell Aleksandr they have a plan. But, as he puts it, a plan is just a document, and a document doesn’t do anything.
A plan says what to do. A process says how: who does what, by when, and how you’ll know it worked. Without a process behind it, there is no way to run the plan, check that it works, or measure the result.
Aleksandr draws a parallel that will be familiar to anyone who has worked in an office. Companies run fire drills. Everyone knows that when the alarm rings, you go outside to a specific meeting point, and organisations rehearse this regularly. So why don’t they rehearse a cyber attack the same way? Let’s imagine we’re attacked right now. What do we do? Who does it? Did it work? That rehearsal is only possible if a process exists to rehearse.
Backups make the point even sharper. Do you have backups? Yes. Have you tried restoring them? Yes, we did it once last year and it worked. But if the last test was a year ago, how do you know they still work today? Testing isn’t a project you complete. It’s a process you repeat.
The Outsourcing Illusion
One of the episode’s most uncomfortable observations concerns who managers think is handling security. Many assume that because they have an IT person, an IT department or an outsourced IT partner, everything is taken care of. Aleksandr calls the outsourced version the worst case, not because partners are bad, but because the arrangement makes it easiest to stop asking questions. Without real actions and real proof, there’s no assurance that an attack’s impact would actually be contained.
How Corners Get Cut, Quietly
Ronnie raises a familiar pattern from manufacturing: corners get cut quietly. Aleksandr explains how it works on the factory floor. Someone skips a quality check. Nothing happens. Two weeks later, they skip another. Nothing happens again. The shortcut becomes the norm.
Security works exactly the same way. The owner has an old phone and multi-factor authentication doesn’t work on it, so let’s make an exception. I’ll share my admin password with you for a while. Then everyone forgets. Offboarding is another classic: the company removes a leaver from Active Directory, but there are a dozen other systems nobody remembers to check. Either the rules were never defined, or they were defined and never followed, or nobody verified that they worked.
NIS2: Discipline, or Better-Documented Hope?
With Estonia’s NIS2 amendments now in force, Ronnie asks the question every board should be asking: is regulation producing real discipline, or just better-documented hope?
Aleksandr’s answer is candid. Since the rules took effect, several clients have asked Lean Digital for help. His first question back is always: do you want to do this because you’re required to, or because you genuinely want to improve your security processes? In most cases, the answer has been: we just have to do it.
He sees the same trajectory as ISO 9001 quality certification in many companies: a document on the wall or on the shelf, while reality carries on unchanged. NIS2 does add something new, a named person at board level who is responsible. But it’s still unclear to many of those people what they are actually accountable for, and what would happen to them if the process doesn’t work. So, once again, everyone hopes.
Ronnie pushes with a practical scenario: a small manufacturing company with a €50,000 budget. What goes on the shopping list? Aleksandr’s honest prediction is that the company will hire a consultant to “do NIS2” for them, end up compliant on paper, and change very little in how they actually operate. For many manufacturers, he adds, the deeper problem is that they don’t yet understand why it matters, only that it’s now the law.
What Lean Teaches Security
Lean is about eliminating waste and standardising processes. So does it translate to security? Aleksandr says yes, in two important ways.
First, efficiency: you should do the things that genuinely improve your protection, not activities that just look like security.
Second, and more importantly, continuous improvement. A core Lean principle is that a process is never “done”. What was efficient today won’t be efficient tomorrow, because the world around the company keeps changing. In cybersecurity that change is accelerating, with ever more capable AI arriving on both sides. Processes need regular dry runs to confirm they still fit the situation.
Ronnie raises a sharp objection: Lean is about removing slack, but security is about resilience, and resilience is rarely lean. Aleksandr’s response is precise. Lean doesn’t demand zero buffers. It demands removing unnecessary buffers. You keep the slack you genuinely need, and in security, that slack is part of the design.
One Metric for the Screen on the Wall
Asked for a single number a manager could glance at each morning, Aleksandr proposes a two-sided process metric: how many cybersecurity processes are defined, and how many are actually working. Test each one on a routine schedule, monthly or quarterly. If it passed its last test, it’s green. If it failed or hasn’t been tested, it isn’t.
He’s explicit about what not to use. “Days without an incident” borrows from workplace safety, but it doesn’t measure your security. Incidents come from outside, and you can’t control whether someone attacks you. A good metric measures something the company controls.
He finishes the thought with a story about Henry Ford, whose factory maintenance crew was supposedly paid for the time the equipment ran without them needing to intervene. Apply the same thinking to security: if your security specialist has nothing to do, it may be because everything is working.
Monday Morning, No Budget Required
The final question is the most practical. What can a listener do on Monday morning that starts replacing hope with process, without spending money?
Aleksandr’s answer: pick one process you already have, such as offboarding, backup restore or access review. Find the person accountable for it. Ask them to show you when it was last run or tested, and what the result was. If there’s no proof, you’ve found your first job. If there is proof, you’re lucky.
Ronnie turns it into an image: a process roulette on Monday morning, where any owner’s process might be the one that gets tested this week. Aleksandr adds the final piece: make process status a standing item in board and management meetings. How many processes are defined, how many implemented, and are we sure they work?
Why This Episode Matters
Most security conversations are about the next threat. This one is about the gap that almost every organisation has, technology bought but discipline missing, and it’s especially timely as NIS2 obligations roll out across Estonia and Europe. You’ll come away with a sharper vocabulary for talking to your board, a metric you can start tracking this week, and a simple test that shows whether your security is running on process or on hope.
Listen to the full episode now, explore more at the NEVERHACK website, and subscribe to the NEVERHACK Cybercast so you never miss an episode.
