The bombs never came. The floppy disks did.
A short account of how a Cold War civil defense council ended up running dark web monitoring.
The Civil Threat Readiness Council
365 Threat Mitigation was founded in 1958 as the Civil Threat Readiness Council, a joint community effort to help American neighborhoods prepare for the possibility of nuclear attack. For nearly forty years, we ran duck-and-cover drills in school gymnasiums, distributed pamphlets about fallout shelters, and maintained what was, by all accounts, an extremely calm phone tree.
The drills were simple on purpose. You didn't need to understand fission to know to get under a desk. That was more or less the whole philosophy: complicated threat, simple practiced response, repeated until nobody had to think about it.
A confusing couple of decades
Then, sometime in the mid-1990s, it became clear that the actual threats facing most American households and businesses had changed shape. We spent a confusing few years trying to figure out whether "Y2K" fell under our jurisdiction (verdict: yes), and by the time the first big ransomware wave hit in the 2010s, the rebrand had basically already written itself.
The name changed a few times before it stuck. The drills didn't, really. We still believe the fastest way to survive something scary is to have practiced it calmly, in advance, with people who've done this before. We just don't hand out fallout shelter pamphlets anymore. Mostly it's patch schedules.
Four things that survived every rebrand
We drill until it's boring.
Repetition is the entire point. A drill you're still nervous about hasn't been run enough times yet.
Calm is a deliverable.
It's not a personality trait, it's a service feature, and we've been refining it since before some of our clients existed.
We've never once said "unprecedented."
Almost everything has a precedent, if you've been doing this since 1958. Especially the boring parts.
If the pamphlet doesn't fit on one page, it's not a pamphlet.
A tradition we've kept from the fallout shelter days, now applied to incident reports.
Yes, we know it's 365.25.
We rounded. It seemed like the kind of thing that would bother exactly one client per year — and every year, without fail, it does. We consider this an acceptable cost of doing business.