Undefeated Until It Isn't

Ask a room full of engineers why a particular safeguard doesn't exist, and eventually someone says it: "It's never happened before." Everyone nods. The meeting moves on. Nobody notices that a statement about the past has just been quietly promoted to a statement about the future, with none of the evidence that promotion would require.

That promotion is the whole trick behind most bad risk conversations in critical infrastructure. The phrase sounds like data because it has a timestamp attached. Five years without an outage. Ten years without a breach. Twenty years since the backup generator was needed for real. Cite numbers like that and you feel like you're reporting a fact rather than offering an opinion. But the fact only describes what happened. It says nothing about what nearly happened, what depended on one tired engineer noticing something at 2 a.m., or what happened to an organization running the exact same setup one town over, quietly filed away as somebody else's bad week.

Call it survivorship bias wearing a hard hat. You are the aircraft that limped home with the fuselage full of holes and the engine untouched, standing in a briefing room explaining why engines clearly don't need armor.

The exposure nobody counts

A system running incident-free for a decade hasn't proven the incident is impossible. It has accumulated a decade of exposure to something that hasn't fired yet, which is a very different claim. Rare events are rare precisely because they're absent from most of the time window you happen to be observing. That absence is consistent with "this cannot happen" and just as consistent with "this happens once every fifteen years, and we're currently on year eleven." From inside a quarterly review, those two situations look identical. From inside the incident, they don't.

What makes this worse than ordinary laziness is that it compounds. Every additional quiet year gets logged as more proof, when it's really just more exposure. Confidence climbs while the underlying risk sits still, or gets worse, because load grew and a redundant system got quietly cut during the last budget round. The engineer who understood the failure mode moved to another job around the same time, and nobody inherited what they knew. The streak reads like an asset on somebody's dashboard. It behaves like a fuse that hasn't finished burning.

The memo always exists

The part that never stops being funny to me is the sequel. When the incident finally lands, nobody says "our model gave this a small but real probability, and this was the year it drew the short straw." The line is always "nobody could have predicted this." Give it a week and someone produces a memo. There is basically always a memo, written months or years earlier by someone who saw exactly this coming, describing the failure mode in careful, hedged language, ending in a recommendation that cost money and got shelved because the thing it warned about had, at the time, never happened before.

The memo did its job. The organization's filing system for inconvenient warnings did not: forget it unless it stops being inconvenient by occurring, at which point dig it up and present it as an unforeseeable twist.

None of this argues for treating every hypothetical as a five-alarm emergency. Most risks really are small, and most mitigations really do cost more than they're worth. A culture that panics over every edge case burns out just as fast as one that ignores all of them. The useful move is separating two questions that "never happened before" quietly collapses into one: has this occurred, and could it. The first is a historical fact, closed and unchanging. Only the second one belongs anywhere near a budget decision.

If you want a cheap diagnostic for your own organization, listen for the phrase in a risk meeting and ask what it's covering for. Nine times out of ten it's standing in for "we don't want to spend the money" or "we don't want to think about this today," repackaged as an empirical observation so nobody has to own the actual decision. The absence of a fire is not a fire code. It's just quiet, for now, and quiet has never once been a control.