Stability Creates Blind Spots

Category: Organisations and systems Calm periods quietly reduce vigilance.

A factory has not had a serious safety incident in eleven years. The record is a point of pride; there is a sign by the entrance counting the days. New starters are told about it. The procedures that produced that record are still in place — the checks, the sign-offs, the protective gear, the rule that you stop the line if something looks wrong.

But the people doing them have changed. Not the individuals so much as the relationship to the task. When you have run a check ten thousand times and it has never once caught anything, the check stops feeling like a safeguard and starts feeling like a formality. You still do it, but you do it faster, with less attention, half-thinking about something else. The gear that is uncomfortable gets worn a little looser. The “stop the line if it looks wrong” rule has never been used, so nobody is quite sure, any more, what “wrong” is supposed to look like.

The long run of safety, which everyone reads as proof the system is working, is quietly doing the opposite. Each incident-free year is teaching everyone that incidents do not really happen here, and that lesson is loosening exactly the vigilance that made the years incident-free. The system is at its most exposed at the very moment its record looks best.

Then one day the thing the checks were for actually happens, and it turns out half the safeguards had been hollowed out for years — not removed, just no longer believed in.

The Principle

A long stretch without trouble does not strengthen a system’s defences; it erodes them. Calm is read as proof that the risk is gone, so the vigilance that produced the calm quietly relaxes — and the danger is greatest precisely when the record looks safest.

The safeguards that prevent a rare event get their entire justification from that event. But the event, by design, almost never happens — so the safeguards spend nearly all their time looking pointless. Over a long enough calm, “we have never needed this” hardens into “we do not need this,” and the protection decays from the inside while appearing fully intact from the outside.

Why It Is Inevitable

Humans calibrate risk from experience, and a long run of safety is a long run of experience that says the risk is low. This is not stupidity; it is how learning works. If a thing has not happened in years, treating it as imminent feels paranoid, and the people who keep insisting on full vigilance start to look like they are crying wolf about a wolf that never comes.

Effort also naturally flows away from things that never pay off. Attention is finite, and a check that has never once caught anything is, by any visible measure, a waste of attention — so attention drifts to the problems that are actually occurring. The safeguard is not abandoned in a decision; it is starved of attention one slightly-rushed repetition at a time.

And success actively rewrites the story. The longer the calm lasts, the more the safety record gets attributed to the place being fundamentally safe, rather than to the safeguards holding back a danger that is still there. The better the record, the more invisible the threat becomes — and the more the protection looks like an over-cautious relic of a more nervous past.

How It Shows Up

• “We’ve never had a problem with that” used as a reason to relax a precaution — the precaution being why there was never a problem.
• Checks performed faster and more mechanically the longer they go without catching anything.
• Drills, backups, and contingency plans that exist on paper but have not been genuinely tested in years.
• Pride in a long clean record, with no awareness that the record is eroding the thing that produced it.
• The people who keep pushing for vigilance increasingly dismissed as alarmist.

Why It Causes Damage

The decay is invisible and the failure is sudden. Because nothing goes wrong during the long calm, there is no feedback to correct the slide; the system feels safer and safer right up until it fails, and then it fails having lost defences nobody noticed were gone. The blow lands on a system that believes itself protected and is not.

The damage is also compounded by surprise and disbelief. An organisation that has internalised “this does not happen here” is slow to recognise the event when it finally arrives, slow to respond, and reluctant to accept it is real — losing precious time to the assumption that this must be a false alarm, because the last however-many years said so.

How To Counter It

• Treat a long clean record as a warning, not a reassurance. Ask: which of our safeguards have not justified themselves in years, and have we therefore stopped truly performing?
• Test the defences deliberately. Run the drill, restore the backup, trigger the alarm — manufacture the rare event on purpose so the safeguard gets exercised and stays believed in.
• Separate “this hasn’t happened” from “this can’t happen.” The first is a record; the second is a fantasy, and the calm constantly tempts you to confuse them.
• Protect the worriers. The person who keeps insisting on vigilance about a risk that never materialises is doing unrewarded, essential work — do not let the calm turn them into a punchline.
• Watch the quality of routine checks, not just their presence. A check done mechanically is closer to no check than to a real one.

What Good Looks Like

Organisations that stay uneasy in good times — that read a long stretch of calm as a signal to test their defences harder, not relax them. Where safeguards are periodically exercised against real scenarios so they never become mere formalities, and where the people who maintain vigilance against rare events are valued rather than tolerated.

They do not mistake the absence of recent trouble for the absence of danger. They keep the wolf in mind precisely because it has not come, knowing that the long quiet is when the door is most likely to have been left open.

A Reflective Question

Think of a precaution in your world that has not “paid off” in years. Is that because the risk is gone — or because the precaution is still quietly working, and you are now one short step from deciding you no longer need it?