The Operational Work You Won’t Need Until You Need It

A medical device company reported earnings this week with three weeks of operational disruption from a March cyberattack absorbed into the quarterly numbers. The company missed analyst estimates by hundreds of millions of dollars and held its full-year guidance, supported by a recovery the CEO described as fast and successful. A second medical device giant disclosed a separate attack a week earlier and reported no operational impact, supported by an architectural decision its engineering team made years before the attack. The story under the story is that the businesses that survive operational shocks are the ones that did the unglamorous infrastructure work early, when nothing was on fire and nobody was asking about it. Understanding the surgical robotics version of this pattern is part of the job for the founders we work with. Making money, building systems, and getting to where you want to go when the systems work depends on operational decisions you make before you have a crisis are the problems The Build exists to help you think through.

The Operational Work That Pays Out Only When You Need It

Every business has a category of work that produces no visible value during normal operations. The work shows up as line items in the engineering or operations plan, gets debated in the budget cycle, and survives or gets cut depending on how patient the leadership team is willing to be with capital that does not produce a measurable return inside the current quarter. The category includes operational redundancy, supply-chain depth, financial reserves, contractual protections, network architecture choices, and the kind of process documentation that nobody reads until the day they need it. Most founders cut some of this work and survive. Some founders cut all of this work and survive for a long time, until one day they do not.

The Stryker recovery this week is a working example of what the work pays out when it has been done. A March cyberattack took the company offline for roughly three weeks, which would be an extinction-level event for a smaller business with weaker recovery infrastructure. Stryker absorbed it, kept its installed base of orthopedic robots running, recovered the operational systems, and reported earnings on a maintained full-year trajectory. The recovery cost real money in the quarter and the customer relationships still absorbed it, because the operational work that supports a recovery of that quality was already in place when the incident hit.

The Medtronic outcome the same week is the cleaner version of the same story. A separate attack on Medtronic’s corporate IT environment was contained with no operational impact reported, supported by an architectural separation between corporate IT and the operational and product systems that makes a corporate IT incident a contained event rather than a global outage. The architecture was a multi-year engineering investment that produced no visible value during the years before the incident, and that produced enormous visible value the day the incident landed.

Why Founders Defer the Work That Saves Them

The reason founders defer the unglamorous operational work is that the work competes for capital and attention against work that produces visible returns this quarter. Engineering capacity spent on network architecture is engineering capacity not spent on the next product feature. Capital reserved for operational redundancy is capital not deployed into the next growth investment. Process documentation that takes a quarter to build looks like overhead next to the deal that closed in the same quarter. Every founder has a list of operational projects that have been on the plan for years and have been slipping each quarter, because the visible work always wins the prioritization debate against the invisible work.

The deferred work has a quiet compounding effect that runs underneath the visible business. Each quarter the operational work is deferred, the gap between the resilience the business needs and the resilience the business has gets a little larger. The gap is invisible during normal operations and during the easy quarters when the cash is good and the customers are happy. The gap becomes the entire story during the quarter when something breaks. The cyberattack, the supplier outage, the regulatory pause, the customer concentration risk, the contractual exposure, the founder departure, the funding round that does not close on schedule, all become operational events that the resilience posture either absorbs or does not. The businesses that absorb the shock keep operating. The businesses that do not, do not.

The Build covers this kind of structural operating decision in practical terms for founders running real businesses. Not at multinational scale, but at the scale where every decision about where to spend the next engineering quarter, the next dollar of capital, and the next senior leadership cycle actually moves the company. What operational work in your business should be funded right now that you have been deferring because the visible operational pressure is on something else? Where is the resilience gap hiding in your plan, and what would it cost to close it now versus to absorb the consequences when something tests it?

What Operational Discipline Looks Like at Operating Scale

The companies that successfully build and maintain operational resilience are not the companies whose founders are better at predicting the next crisis. They are the companies whose operating systems treat the resilience work as the design, not as an exception. The work has named owners. The work has milestones reviewed alongside the visible business milestones in the same operating cadence. The work has a capital line that survives the difficult quarters when the easy operational move would be to defer it for another cycle. The work has executive participation in the rehearsals and the tabletop exercises that prove the resilience posture actually performs the way the documentation says it does.

Building that operating system is harder than running a sequenced plan in any single quarter. The compensation across multiple years is that the resilience-disciplined business arrives at the moment of the operational shock with the work already done, and the deferred-work business arrives at the same moment with the resilience gap fully exposed. The differential is what determines whether the shock becomes a recoverable event with revenue cost in a single quarter or a structural event with consequences for the business for years.

The companies that win at this design work do specific things that are easy to defer. They write the resilience plan with the same rigor as the growth plan, and review it with the same operating cadence. They staff the resilience function with senior ownership, not with a single specialist reporting into the operations team. They rehearse the operational response to a disruption before there is a disruption, with the executive team participating, so that the response is documented, practiced, and credible when the real event lands. They protect the resilience capital line during the difficult quarters, when the visible business pressure makes the deferral look like the responsible choice and the slow accumulation of resilience debt is the actual cost.