Code, Crisis, and Bloodlines

On July 19, 2024, CrowdStrike pushed a faulty Falcon sensor configuration at 04:09 UTC. Roughly eight and a half million Windows machines blue-screened. The fix was straightforward and brutal: boot each affected device into Safe Mode with Networking, delete one file, reboot.

For a hospital, “each affected device” is every clinical workstation, badge reader, imaging system, charting terminal, and executive laptop, all at once. For a hospital system spread across Pennsylvania and New York, with me running my piece from Delaware, “each affected device” was also several hundred miles away from my hands.

This was an org-wide effort. Clinical leadership, infrastructure, security, communications, command center, partner vendors on site, and every nurse, tech, doctor, and admin willing to pick up a manual downtime procedure. I want that on the record before I describe my workstream, because no individual gets credit for that day. We all do.

My piece of it, from Delaware

I was in Delaware. The hospitals were in PA and NY. My presence in their conference rooms was a camera and a screen, and my contribution to the response was three parallel tracks that fed back into what the team was already doing on the ground.

Track one was assisting the front line. Critical care could not wait for an elegant solution. I helped the nurses, techs, and doctors one workstation at a time, walking them through getting their devices back online so they could move off paper downtime procedures faster. The clinical teams kept patients safe through hours of manual workflow; my contribution was shortening their time on paper as much as I could.

Track two was assisting the executive layer. The Information Security conference room in PA had me projected on its large TV. Internal C-Suite leaders and on-site partner executives packed that room, coordinating the fallout in real time. I was on Microsoft Teams calls to executives’ cellphones, walking them through restoring the laptops on their desks step by step. As each one came back, that leader could lead again, and the org could resume top-level operations and communications.

Track three was automation. I wrote and iterated remote-recovery scripts that would connect to any device once a user had it booted into Safe Mode with Networking, delete the bad CrowdStrike file, and bring the machine back online. The scripts ended up being deployed in a few specific areas rather than fleet-wide, but they were beneficial where they ran, and the work was a real learning experience for me and several teammates on the IT side. Test, modify, deploy, listen, repeat.

Three threads of contribution. Hundreds of miles of distance. One steady voice into a room full of people doing the rest of the work.

The room I was not standing in

People later told me I was the calmest person involved. I did not raise my voice. I did not signal frustration on camera. I did not perform calm, I just was calm. Leadership commended the technical execution and, even more, the demeanor.

The optics mattered. A packed conference room of senior leaders managing a once-in-a-career outage will mirror the tone of whoever holds the floor. From a screen in Delaware, I held my piece of that floor. That is what remote leadership looks like inside a larger live response.

Where the calm came from

My grandfather, James Robert “Big Jim” Richardson, was an airplane mechanic and engineer during the Korean and Vietnam wars. He told me stories of taking enemy fire while continuing to work on damaged engines, because if his job went undone the mission collapsed.

Big Jim’s lesson was mission first. Mine evolved one degree: the team is the mission. By absorbing the operational weight I can carry, and staying calm while I do, I free the people around me to do their work, which is what makes the mission possible at all.

Every cybersecurity incident a hospital weathers, whether ransomware, a vendor outage like CrowdStrike, credential compromise, a supply-chain breach, a misconfiguration cascade, a live zero-day, or any other genuinely stressful situation, I am honoring Big Jim’s lesson, scaled across state lines and decades, into a form he might not have recognized but would have approved of. Each one wears a different mask. The shape changes, the timeline compresses or stretches, the playbook differs in detail, and the surface area to triage keeps expanding. The work underneath does not. Damaged engine, damaged endpoint, same job: keep working until the mission is back, while the people next to you do the same.

In his nineties, Big Jim would see news on TV about hackers and breaches. Not long before he passed, he asked me, “So you’re the guy that stops those bad hacker guys, yeah?” Yeah, Big Jim. One of them.

My father, James “Randy” Richardson, was an all-American football player in high school and a high performer in college. Randy taught me how to prepare for game day, how to show up, and how the way you carry yourself communicates long before the work product does. Big Jim taught me to keep working under fire. Randy taught me that how I show up while I work is half the work itself. That is its own post, coming later.

Three notes for the next responder

If you ever land in a room like that one, or in a Teams call into a room like that one:

• Match the work to how your brain runs. Multi-threading three tracks is an ADHD strength I happen to have. Plenty of brilliant responders run one focused track at a time and crush it. Pick the lane that fits how you work: the work that protects the people who can least afford the outage first, the work with the highest leverage next, or the work that fits your background after that. Own your lane and trust the rest of the org to carry the others.
• Tone is information. People watch how you respond before they listen to what you say. A steady voice is a deployable asset. Conserve it, and amplify the calm of the people working next to you.
• Inheritance is real. If you have someone in your life who already showed you how to hold the line under fire, name them, and draw on it. I think about Big Jim and Randy a lot on hard days.

Stay sharp. Build for the worst case. Take care of the people first, then finish the work, together.

Sources: Inline links verified on 2026-05-14. CrowdStrike outage facts from the Wikipedia summary cross-referenced with CrowdStrike’s Falcon Content Update post-incident report.