Iron Man

Synopsis

A billionaire CEO discovers his organisation has a governance problem.

Unfortunately, he discovers this whilst being held hostage in a cave.

What follows is a complete operating model transformation involving insider risk, supply chain failures, inadequate oversight, shadow IT and an unauthorised production deployment of a powered exoskeleton.

In other words, a fairly standard transformation programme.

Review

Iron Man is not really a superhero film.

It is an IT governance film with explosions.

Tony Stark starts the movie as the founder every organisation secretly fears.

Brilliant.

Charismatic.

Successful.

Completely convinced the rules do not apply to him.

The company is thriving.

The share price is strong.

The technology is impressive.

And absolutely nobody has any idea what is actually happening underneath.

Which, as it turns out, is a problem.

The first warning sign appears when Stark discovers his weapons are being used by people who definitely should not have them.

At this point most organisations would launch an audit.

Tony Stark launches an existential crisis.

Then gets kidnapped.

Which admittedly is a less common governance response.

What follows is perhaps the most impressive proof of concept ever delivered.

Tony is trapped in a cave.

No project team.

No steering committee.

No architecture board.

No governance framework.

No PMO.

No weekly status report.

No PowerPoint.

And somehow still delivers a working prototype ahead of schedule.

Meanwhile Stark Industries has thousands of employees and cannot even keep track of where its products are ending up.

The contrast is remarkable.

Then there is Yinsen.

The forgotten hero of the project.

Every successful transformation has somebody doing the important work while somebody else gets all the credit.

Yinsen is that person.

Without Yinsen there is no Iron Man.

There is no platform.

There is no transformation.

There is no movie.

Yet somehow nobody ever talks about him.

Which is exactly what happens to good engineers.

Back at Stark Industries we meet Pepper Potts.

The only functioning governance process in the entire company.

Pepper spends most of the film doing what every competent programme manager eventually ends up doing:

Keeping everything from collapsing.

Managing stakeholders.

Managing risks.

Managing Tony.

Which is easily the hardest of the three.

Then we arrive at JARVIS.

The greatest employee in cinematic history.

Never misses a deadline.

Never misses a requirement.

Never complains.

Never calls in sick.

Always available.

Always accurate.

Always delivers.

Most organisations would probably make him redundant during a cost-saving exercise.

Which tells you everything you need to know about most organisations.

Then there is Obadiah Stane.

The real lesson of Iron Man.

Because Stane is not an external attacker.

He is not a hacker.

He is not a foreign nation state.

He is a trusted insider.

He has access.

He has authority.

He has influence.

He has permissions that nobody has reviewed for years.

In other words:

He is exactly why access reviews exist.

The entire plot could have been avoided with a decent insider risk programme and some regular entitlement reviews.

Instead the organisation waits until the executive leadership team starts trying to murder each other.

Which is generally considered late in the lifecycle.

What makes Iron Man work so well is that Tony’s greatest strength is not the suit.

It is the engineering.

He observes.

He learns.

He adapts.

He improves.

Version one works.

Version two works better.

Version three catches fire slightly less often.

This is how technology should be built.

Iterate.

Improve.

Learn.

Repeat.

Instead of spending eighteen months producing PowerPoint slides and then acting surprised when nothing works.

The Scorecard

Story: 5/5

Tony Stark’s Ego: 10/5

Engineering: 5/5

JARVIS: 100/5

Pepper Potts’ Patience: 100/5

Governance: 0/5

Access Reviews: 0/5

Insider Risk Management: 0/5

Likelihood of Watching Again: 5/5

Likelihood of Recommending to Others: 5/5

Overall Score: 5/5

Final Verdict

Iron Man is what happens when a highly capable engineer discovers his organisation has no governance, no oversight and a significant insider risk problem.

Most organisations would have started with a steering committee.

Tony started with a flamethrower.

Both approaches have risks.

Only one produced Iron Man.

Completely Unqualified Verdict

Stark Industries spent billions building weapons.

Tony Stark spent a few weeks in a cave building a better solution.

Guess which one changed the world.

⭐⭐⭐.5 3.5 out of 5 stars