Chapter 3 - Attack by Stratagem

---

Modern crises rarely appear without warning.

"To subdue the enemy without fighting is the acme of skill."  - Sun Tzu

Many crises are not sudden events. They emerge gradually through a series of overlooked warning signs, unresolved issues, and missed opportunities to intervene.

By the time a situation is formally declared a crisis, the organisation has often been presented with multiple opportunities to change the outcome. In Attack by Stratagem, Sun Tzu argues that the highest form of victory is achieved not through confrontation, but through strategy.

The best leaders shape events before conflict becomes unavoidable, creating conditions where the battle never needs to occur.

• Modern crises rarely appear without warning. A cyber incident may begin with an unpatched vulnerability.

• A reputational issue may start with a customer complaint that receives little attention.

• An operational disruption may stem from a known dependency that has never been fully assessed.

While every crisis is different, many share a common characteristic: the warning signs were present long before the consequences became visible.

The challenge for organisations is recognising and acting on these indicators before they escalate. Effective crisis management is not limited to response plans and recovery procedures. It also involves identifying emerging risks and intervening early. This often means paying attention to:

• Recurring operational issues

• Near misses and minor incidents

• Employee concerns and internal reporting

• Supplier and third-party dependencies

• Security vulnerabilities and control weaknesses

• Changes in stakeholder expectations or sentiment

One of the most valuable outcomes of preparedness activities is the ability to uncover vulnerabilities before they are exposed by a real-world event. Exercises and simulations frequently reveal:

• Gaps in decision-making authority

• Unclear escalation pathways

• Communication challenges

• Conflicting priorities between teams

• Assumptions that have never been tested

Every organisation wants to believe it will perform well in a crisis. The reality is that confidence is often tested by events that have been developing long before the crisis is officially declared.