We’ve been to BCI World! In today’s bulletin, Charlie discusses the exhibitors and speakers at the recent BCI World Hybrid 2026 in London and gives an insight into this year’s topics.
This week I did my annual sojourn to BCI World and, as I have done for the last few years, I thought I would use my visit to reflect on what you can glean about the state of the business continuity industry from attending the event. The views expressed are entirely my own observations, so they are an opinion, rather than being based on facts and figures from the organisers of the conference.
So, what did I observe?
The march of women into the profession has continued to increase. My very rough estimate was that a third of the attendees were female. Over the 20 years I have been going to the BCI conferences, this has increased from an entirely male-dominated industry to one which has seen a year-on-year increase in female representation. The speakers must have been about 50% female, so it shows that some of those who joined several years ago have reached the seniority level to be sharing their knowledge with peers. So, we have come a long way!
The age of those attending seems to be going down, or is it just that I have got older and the average age has remained the same? Again, similar to last year, there was a good representation of European attendees, perhaps fewer from the Middle East, and a sprinkling of African representatives. I was speaking to one of the software vendors and they were saying that their growth areas are Scandinavia and the Middle East. It was good to see that the Bank of Botswana got a prize, who we worked with a few years ago.
It was interesting to see that most of the talks had resilience somewhere in their titles, and resilience was very much the word of the conference. When people were talking about resilience, I didn’t really feel that they were showcasing any new tools and techniques. There were variations on business continuity methodologies or new / different ways of implementing them. I think the difference was that resilience has a more universal appeal across an organisation, spans a wider scope, and attracts more senior management interest than business continuity, which was always more siloed and much more middle-management-focused.
I overheard a conversation about whether business continuity should report into the Chief Resilience Officer (CRO), so those with resilience roles are making it to the C-suite, which never seemed to be the case pre-resilience. I have never heard of a Chief Business Continuity Officer.
There was a limited number of presentations on AI, and the talks moved away from a bugbear of mine: the idea that AI is only good for creating videos and pictures for exercises. The talks, including mine and Konstantin’s, were about the more general use of AI across all elements of the delivery of business continuity. In my presentation, I talked about the use of video narrated by an avatar to deliver training and awareness sessions and found that, of the 40 or so people in the talk, none were using it. I think there is a very mixed level of AI usage across the profession, which I think is sometimes driven by the cultural use of AI in an organisation and which tools people’s organisations allow them to use.
In business continuity, or at least in the BCI conference talks, cyber is out of fashion. The Databarracks wargame and another session, which I was disappointed to miss, on the Hydro-Québec cyber attack case study, ‘Preparing for and surviving a catastrophic loss of all IT and OT systems’, were among the very few discussions on cyber. We know that attacks on organisations continue at pace, but perhaps, as a profession, we have done what we are going to do with cyber in terms of planning and are moving on to new threats.
With cyber attacks moving from encrypting systems across an organisation towards simply exfiltrating data, the impact on organisational operations is greatly reduced. Cyber attacks become a high-level crisis team discrete reputational issue rather than an organisation-wide issue where business continuity plans are activated to achieve continuity of operations.
Exercising seems to have replaced cyber as a topic. With Conducttr as the sponsor, there were likely to be lots of talks on exercising, but exercising seems to have replaced cyber and AI as the flavour of the month among BC professionals. The timing of my book couldn’t have been better!
In terms of vendors, which I think is always a good indication of the state of the industry, there were not that many. There were some software vendors, but they were, on the whole, the usual suspects, apart from RAYVN, who I don’t remember seeing last year. There were a number of exercise software providers and two companies which deliver exercises – 4C Strategies and Databarracks – and, of course, the BCI training providers.
There were none of the big consultancies nor any really large companies there, so I think many of them see no need to go to the BCI event. I was lamenting with some other delegates that gone were the days when large companies, such as Sungard, would bring huge stands with lots of people, which you see at the larger IT or cyber conferences. There were two notification vendors, but that market seems to have consolidated and there wasn’t half the number of vendors that there used to be. My overall impression is that the business continuity industry is niche and, as a result, the suppliers are smallish, specialised companies, and the larger companies don’t see the worth in being vendors at the event.
A few innovations caught my eye. There was a presentation on the Minimum Viable Company, which seems to be a hot topic on LinkedIn and is being promoted by the Big Four as the next new thing. I think big consultancies always need to develop something new to sell to their clients. I like the concept and I think it has something to add to the way we deliver business continuity. It seems to have more traction in the retail sector, so we may see it as a theme in future conferences.
I was also interested to see the presentation of a crisis management maturity model by Resilience Scan and its accompanying tool. Personally, I think maturity models in business continuity are an excellent innovation, as how else can we prove to senior managers and those who hold the purse strings that our business continuity is getting better? We need to be able to demonstrate improvement and prove the return on investment for our work and our budget.
I am writing this in the middle of the Microsoft outage, so I am not sure when it will go out!
I do always think the BCI conference reflects the state of the business continuity profession and gives us an insight into what is hot within the profession. All I can say is, roll on next year.
Thank you to all customers who visited our stand, we look forward to seeing you there again next year!