And the shame for any businesses who fall back on this excuse is, their disaster recovery or business continuity plans should have already taken into account the necessity that a large section of their workforce may need to work outside the corporate network. There's zero reason not to have this planned out as a real possibility. Natural disasters, fires, terrorism, power outages, the list of possibilities is almost endless for reasons why business can't be done at one planned location.

I work as a security consultant and I've had companies tell me they can't plan on working from home because of culture issues (aka bosses want to see their employees in front of them). And yet all of them have disaster recovery datacenters or multi-zone cloud setups because they know inevitably a tornado or earthquake or fire or ice storm or something will impact their main datacenter. But no plans for their employees because of "culture".

How much good do you think those disaster recovery datacenters actually do?

Adapting all our software for multi-region was an epic lift. Really, we had to stop thinking of it as "the backup datacenter" and instead run a portion of traffic there continuously. Most teams dragged their feet until we started weekly failover drills, which would usually break something in a big way. Application owners got embarrassed into compliance over the course of a few years. They're less exciting now, but still the proximate cause of some outages.

Given all that, I just can't imagine that a company which has never actually cut over (or attempts it only in quarterly/annual all-hands-on-deck events) is going to have a fun time when it becomes necessary to flip the switch for real. We fought tooth and nail to build this capability and it still takes balls of steel to press the button.

I have never worked with a client who did not test their DR solution. If they were not under regulation to test, they had customers who demanded they test. Although yes it’s mostly quarterly.

You’re right it’s not fun. It’s not easy. It’s all hands on deck at most companies. But disaster recovery isn’t something you can build after the fact so even a neglected DR solution is better than none. If a tornado or earthquake rips through your main DC, you’re not getting those machines or that data back. How much good that does depends on how much you like staying in business.

So is the goal just to have something to work with in order to get back online? I guess that is more achievable than trying to maintain continuous service, which is what ours are about (failover isn't just for black swan events, but for ordinary outages too).

We tend to differentiate between disaster recovery (where downtime is acceptable) versus high availability (where downtime is not acceptable). High availability is much harder and more expensive.

DR typically means your business is down and all hands bring it back at another location at bare minimum capacity just to keep money flowing.

Do you wear a hard hat all the time ? If not, then how do you plan for an evitable brick falling on your head ?

People at construction sites are required to wear a hard hat all the time just like company policies require firewalls to be placed on corporate networks. Not really sure why you're making this comparison, because connecting to the Internet is very much like walking into a construction site where bricks could be falling everywhere and even aimed directly at you.

We have a pretty good idea as to where bricks are likely to fall on our heads. We require people to wear hardhats in all of those locations.