If It Lives in One Person's Head, It Is a Risk

The Decision in Front of You

Every operations leader knows the name. It belongs to the engineer who built the order integration, the administrator who set up the payment gateway, or the contractor who is the only person who has ever patched the warehouse system. When something breaks at 2 a.m., the plan is to call that person.

The decision is whether to treat that arrangement as a continuity risk the board sees priced. This paper argues it should. A business that would not accept 60% of revenue from one customer is often accepting 100% of recovery capability from one employee, with no contract, no notice period that matters during an outage, and no backup.

Outages last longer when the one expert is unavailable, and a departure can turn into months of reverse engineering. Concentrated access adds a security exposure, since one compromised or exhausted person can become the way in.

What's Happening

Experienced staff are leaving, and few companies capture what they know

Uptime Institute's December 2025 staffing analysis found enterprises were more than five times as likely as colocation providers to lose an employee with over ten years of tenure, and it attributed many of those departures to retirement ¹. Nearly a quarter of respondents named staff retention as their single greatest challenge, and formal mentorship offerings at enterprises fell 12 percentage points in a year ¹.

A 2025 survey of 1,000 professionals by APQC found 92% of organizations do not consistently capture knowledge from employees nearing retirement, and 58% of C-suite respondents reported serious concern about knowledge loss ². The study was sponsored by a knowledge-management software vendor, so read the figures as directional.

Government systems show where this ends. The U.S. Government Accountability Office reported in July 2025 that 11 critical federal legacy systems ranged from 23 to 60 years old, and eight of them used outdated languages, including COBOL and assembly code at Treasury ³. GAO noted a dwindling number of people with the skills to support those languages. Agencies spend about 80% of more than $100 billion in annual IT spending on operating and maintaining existing systems ³. Private companies carry smaller versions of this in ERP customizations and scripts nobody else has read.

The open-source supply chain carries the same risk, at scale

Most companies also depend on software maintained by one or two people outside their walls. A 2024 Tidelift survey of more than 400 maintainers found 60% were unpaid and 60% had quit or considered quitting their maintenance work ⁴.

xz Utils, March 2024. XZ Utils, a compression library in most Linux distributions, had for years one maintainer, Lasse Collin. In June 2022 he told a public mailing list he was dealing with long-term mental health issues and that a newer contributor, Jia Tan, might take a bigger role ⁵. By 2023 Tan was merging code. In February 2024, versions 5.6.0 and 5.6.1 shipped with a backdoor that targeted remote login on Linux servers, rated 10.0, the maximum severity, by NIST's National Vulnerability Database ⁵⁶. Andres Freund, a developer at Microsoft, found it while chasing a small performance slowdown and disclosed it on March 29, 2024 ⁵⁷. Experts said it was caught before the affected version was widely deployed ⁵. Freund said the industry got unreasonably lucky ⁵. The attacker had posed as a helpful volunteer to an overloaded single maintainer and earned trust over months before inserting the code ⁵.

Ingress NGINX, November 2025 to March 2026. Ingress NGINX routes outside traffic into Kubernetes clusters. In November 2025 the Kubernetes project announced its retirement. The maintainers wrote that only one or two people had done development work, on their own time after work hours and on weekends, and that even announcing the wind-down failed to attract more help ⁸. Best-effort maintenance ended in March 2026, with no security patches after that ⁸. An industry report cited by The New Stack found half of Kubernetes users still ran it in 2025, a year after a critical flaw rated 9.8 was disclosed in it ⁹. Each of those users inherited a migration on a schedule set by two volunteers' capacity.

npm, September 2025. An attacker phished the account of a single maintainer of 25 popular JavaScript packages, including two called chalk and debug, which together see hundreds of millions of downloads a week ¹⁰. The malicious versions tried to steal data and rewrite cryptocurrency wallet addresses in browsers ¹⁰.

A case worth knowing: the UK air traffic failure

On August 28, 2023, the UK's national flight planning system for air traffic control failed. The Civil Aviation Authority's independent review, published in November 2024, estimated more than 700,000 passengers were affected, about 300,000 of them through cancellations ¹¹. The trigger was a flight plan with duplicate waypoint names, a combination the system had never encountered ¹². Press coverage put the cost to the aviation industry at about £100 million ¹².

Much of the delay traced to staffing. The senior engineer able to fix it was rostered on call from home on one of the busiest days of the year. The engineer was reached 34 minutes after the failure, could not log in remotely, and arrived on site about three hours and 15 minutes after the incident began ¹². The system's manufacturer was not contacted for more than four hours, and once called it found a fix within 30 minutes ¹². The review's 34 recommendations include NATS reviewing its contingency and engineering resource management ¹¹.

Why the Usual Approach Fails

Most companies respond to key-person risk by asking the expert to write things down. That request rarely succeeds.

The expert is rewarded for speed. Every hour spent documenting is an hour not spent on the project leadership is watching. Documentation has no customer, so nobody checks it, and a wiki page written once decays as the system changes while people go on trusting it.

Credentials concentrate quietly. The person who built a system often holds the only administrator account, the only hardware token, or the only relationship with the vendor's support engineer. NATS showed how much time a login problem and an unmade vendor call can cost ¹².

The standards already expect more. NIST SP 800-34 Rev. 1, the U.S. federal contingency planning guide, says recovery teams should be sized to stay viable when some members are unavailable, with a designated alternate for each team leader ¹⁴. It says staff should be trained well enough to carry out their recovery roles without the plan document in hand, at least once a year, and that contact lists need more frequent review than the rest of the plan ¹⁴. The guide dates from 2010 and remains NIST's current version. ISO 22301:2019, the international business continuity standard, requires a documented management system that is maintained and improved ¹⁵, and auditors expect current evidence that the people named in the plan are competent to carry it out ¹⁶.

The Framework: The Handback Test

A system is handback-ready when the company could take it back from its current owner tomorrow and keep running. The test has five checks, and a system passes only when all five are true.

1. A second person. At least two named people can operate and restore the system, and they do not share a manager, a shift, or a vacation calendar.
2. A runbook someone else has run. Restore, restart, and failover steps are written down and have been executed by the second person, with the author watching and not touching the keyboard.
3. Company-held access. Every credential, token, certificate, and vendor support contract sits in a company vault or account. No production access depends on one person's phone or personal email.
4. A known escalation path. The runbook names the vendor, the contract number, and the point at which to call them. NATS lost hours before calling a manufacturer who fixed the problem in 30 minutes ¹².
5. A timed drill. Once a year the second person restores the system while the primary owner is unreachable, and the time to restore is recorded.

flowchart LR
    A[Inventory<br/>critical systems<br/>and their experts] --> B[Score<br/>bus factor<br/>and exposure]
    B --> C[Write<br/>runbook and<br/>move credentials]
    C --> D[Swap<br/>second person<br/>restores alone]
    D --> E[Report<br/>time to restore<br/>to the board]
    E --> A

Documentation that only its author has executed is an untested backup. The swap drill reveals the missing step, the expired password, and the server nobody listed.

Putting a price on it

The model below is illustrative for a hypothetical regional distributor whose order integration is maintained by one senior engineer. Replace each assumption with your own.

On these assumptions the first year of mitigation costs about $34,000 and reduces expected annual exposure by about $243,500. The probabilities are the softest inputs. If the expert is unavailable half as often, the reduction is still about $131,500 a year.

Costs, Risks, and Tradeoffs

The approach also slows the organization in the short term. A team of five that spends a quarter cross-training will ship less that quarter. Show that cost on the same page as the exposure it retires.

How to Act

Questions to Ask Your Team

1. Which systems would stop if one specific person was unreachable for a week?
2. For each critical system, how many people have restored it in the last year, and when?
3. Which production passwords, tokens, or vendor accounts belong to an individual instead of the company?
4. When did someone other than the author last follow one of our runbooks from start to finish?
5. Who on the team is within five years of retirement, and what do they know that nobody else does?
6. Which outside software do we depend on that is maintained by one or two volunteers?
7. In our last three incident reviews, did anyone ask who was unavailable and whether it mattered?

Closing

A company that discovered 100% of its revenue came from one customer would fix it before the next board meeting. Many companies carry the same concentration in the people who can restore their systems, and the exposure rarely appears on any report. Count it, price it, and require every critical system to pass a handback test. When the person who holds the knowledge leaves, the system should stay behind and keep running.