We changed one thing in the help desk: If you mark a ticket CRITICAL, the system now automatically: Pages IT Opens an incident bridge Emails your manager Emails my manager Asks for estimated revenue impact Asks how many employees are blocked Requires you to join the bridge until service is restored Yesterday: “Wireless mouse battery low” Priority: CRITICAL Incident bridge opened. User joined. His manager joined. My director joined. I asked: “How many employees are unable to work?” “One.” “Estimated revenue impact?” “I don’t know.” “Is there a workaround?” He plugged the mouse in. Incident resolved. For years people marked everything critical because they thought it moved them to the front of the queue. It did. Now they have to come with it. Critical tickets dropped 94% in one week. We didn’t change the definition of urgent. We added witnesses.

Security called me at 6:12 AM today. "Patch every PHP server immediately." I asked what happened. "Two critical vulnerabilities. Remote code execution. No authentication required." Cool. How many PHP servers do we have? According to inventory: 12 According to reality: Nobody knows. We found one running WordPress. Three running old internal tools. One under someone's desk. Two inside vendor appliances. A forgotten employee directory from 2016. And a server named: PHP-OLD-DO-NOT-TOUCH Naturally, that one runs payroll exports. Then we found a PHP 5.6 box. I asked who owned it. The documentation said: BRIAN. Brian left in 2019. We called Brian. He said: "Oh wow, that's still running?" Excellent. By 8 AM, leadership joined the incident call. CEO: "Can hackers actually get in?" Security: "Potentially yes." CEO: "Without a password?" Security: "Yes." CEO: "Then why do WE need passwords?" Not the lesson. Finance asked if we could wait until the weekend to patch because downtime affects revenue. Security explained that the alternative was letting strangers execute code on our servers. Finance asked for a cost comparison. At 9:17, someone suggested temporarily taking the vulnerable websites offline. Marketing refused. "Our campaign is live." So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover. We finally patched everything we could find. Then our scanner discovered another PHP server. Hostname: TEMP-PHP-2014 Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down. But every time we block network access, the warehouse stops printing shipping labels. Security has classified it as critical infrastructure. It is running PHP 5.4. The vulnerability has existed longer than half our employees. The emergency patch took four hours. Finding out what PHP actually runs took eleven. The internet isn't held together with code. It's held together with servers everyone is afraid to turn off.

Finance told IT to automatically reclaim any software license that hasn’t been used in 30 days. Great idea. Except requesting a license takes 12 business days. So employees adapted. On the 29th of every month, designers open Photoshop. Analysts open Tableau. Engineers open whatever horrifying $900/year tool they need twice a quarter. They don’t use them. They just launch them. Finance’s dashboard now shows: LICENSE UTILIZATION: 97% The CFO presented this at the quarterly meeting as proof the optimization program was working. It is. Before the policy, people used software when they needed it. Now 600 employees perform a monthly religious ceremony so Finance doesn’t take it away. We have achieved near-perfect utilization. Nothing is being utilized.

We hired our third David Miller. HR asked IT to “make the email addresses intuitive.” David Miller #1 already had [email protected]. David Miller #2 got [email protected]. So David Miller #3 got [email protected]. Simple. Then David Miller #1 quit. HR asked me to rename #2 to david.miller. Can’t. His old address is tied to payroll, CRM, SSO, expense reports, Slack, GitHub, benefits, and approximately 40 systems nobody remembers setting up. HR: “So David Miller 2 stays David Miller 2?” Yes. Then David Miller #3 quit. Last month we hired another David Miller. HR said: “Great, he can be David Miller 3 now.” Absolutely not. That identity belongs to a former employee and is retained for seven years. New David is david.miller4. There is currently one David Miller at the company. His email says he is the fourth. Corporate IT is basically medieval succession law.

Compliance decided mandatory training must remain available during an internet outage. So IT was told to store the videos locally on every laptop. Brand reviewed them. “1080p isn’t premium enough.” Now they’re 4K. Security reviewed them. “Local content must be encrypted.” Done. Result: 24 GB of mandatory training videos on every employee laptop. 900 laptops. 21.6 terabytes of identical videos. Within a week people started opening tickets because their drives were full. Finance asked why IT needed to buy larger SSDs. I suggested we stream the training instead. Compliance reminded me it had to work during an internet outage. I asked when someone would urgently need to complete annual ethics training while the entire company network was down. They said: “That’s not the point.” One of the mandatory courses is called: DATA MINIMIZATION: ONLY STORE WHAT YOU NEED We currently maintain 900 offline copies.

Finance updated the asset policy. “Every company-owned electronic item over $10 must be individually tracked.” I asked: “Cables?” “Yes.” “Chargers?” “Yes.” “USB adapters?” “Yes.” “You’re sure?” “Policy is policy.” Perfect. IT spent two weeks putting asset tags on 3,842 objects. Then quarterly inventory arrived. Finance wanted physical verification of every tagged asset. One $12 USB-C adapter was missing. They opened an asset variance investigation. My manager had to sign a loss form. Finance reviewed it. Accounting adjusted the register. Estimated labor cost: $640. Replacement adapter: $12. The CFO eventually asked why we were spending hundreds of dollars tracking things worth twelve dollars. I forwarded him the policy. Threshold changed to $500 the next morning. Then Finance told us to remove the 3,700 unnecessary assets from the system. Unfortunately tracked assets cannot simply be deleted. They must be formally disposed of. Finance is currently processing 3,700 disposal records for cables we still own. Policy is policy.

Comms made IT auto-generate everyone’s email signature from the HR system. “No manual edits. One source of truth.” At 7:00 AM the sync ran. By 7:12: A junior analyst discovered he was now a Senior Analyst. Two managers learned they reported to a VP they’d never met. A Sales director’s signature changed to: REGIONAL SALES DIRECTOR — EAST Nobody had announced that Sales was being split into regions. HR called me in a panic. Apparently they had loaded next month’s reorg into the HR system early because: “Nobody can see the backend.” They forgot Outlook can. Comms asked if we could temporarily override the signatures. No. Your entire requirement was “one source of truth.” For 12 minutes the most accurate source of organizational news in the company was the bottom of an email about bagels.

HR launched an “anonymous” employee engagement survey. Then they asked IT to build a dashboard with filters for: Department Manager Office Job title Tenure I built it. Then I selected: Finance Accounts Payable Chicago Senior Analyst 5–10 years Responses: 1 Satisfaction score: 1/10 Comment: “My manager turns every problem into a meeting.” HR stared at the screen. “Can we see who wrote that?” I said there is literally one employee matching these filters. “But the survey is anonymous.” Correct. You asked me to build a machine that narrows anonymous people down to one person. Long silence. We removed job title. 2 people. Removed tenure. 4 people. Eventually I set a minimum group size of 10 before results appear. HR complained the data was now “less actionable.” Yes. That is the technical definition of anonymity. The lowest-scoring survey statement was: “I trust leadership to handle employee feedback appropriately.” HR asked if we could identify who selected that answer. Thank you for validating the result.