In 1943 with American bombers being shot out of the sky over Europe the US military brought a simple question to a group of statisticians at Columbia University after carefully mapping the bullet holes on the planes that came back from missions where the damage clustered heavily on the wings, fuselage, and tail while the engines were comparatively clean. Armor is heavy so you cannot cover the whole aircraft and the obvious move was to reinforce the areas that were clearly taking the most fire, but one member of the group, a Hungarian refugee named Abraham Wald, told them they had it exactly backwards because they were only looking at the planes that made it home. The bullet holes on those survivors showed all the places a bomber could be hit and still fly, and the engines looked clean not because they were rarely struck but because the planes hit in the engines were lying at the bottom of the sea absent from the data entirely, so the armor belonged precisely where the returning planes showed no damage because that was the damage no one survived to show you. This is survivorship bias and once you see it you start finding it everywhere because it is the default way human beings learn, studying the successes because they are still standing to be studied while the failures, who very often did many of the same things, are simply invisible.

On a snowy morning in December 1974, TWA Flight 514 flew into a Virginia mountainside on its approach to Washington killing everyone aboard after a misunderstanding between the crew and air traffic control about how low they were cleared to descend, and the detail that haunts the story is that just six weeks earlier a United Airlines crew had made almost the identical mistake near almost the identical ridge, caught it in time, and reported the close call inside their own airline. The knowledge existed and it simply had nowhere to go because in 1974 there was no way to share one airline's near miss with the rest of the industry so a second crew flew into the mountain the first crew had only grazed. The response to that crash built the Aviation Safety Reporting System run by NASA as a neutral third party where pilots, controllers, and crew can confidentially report their own mistakes and near misses without being punished, and more than two million reports later it has become one of the quiet engines of the safest complex system humans have ever built by assuming error is constant and building a machine for catching the small ones before they grow into fatal ones.

In 1975 a young engineer at Kodak named Steven Sasson built the first digital camera and Kodak patented it, and over the following decades Kodak did not ignore digital photography the way the legend suggests but developed it, held a deep portfolio of patents, and for a stretch in the early 2000s were among the top sellers of digital cameras in the world. They were not blind and they were not incompetent and in 2012 they filed for bankruptcy anyway because the interesting part of the Kodak story is not that they missed the future but that they saw it, owned it, and still drifted past it since for thirty years the most rational move in any given quarter was to protect the enormously profitable film business in front of them. No single decision was fatal because the failure was assembled out of a long series of perfectly reasonable quarters, and this is the shape of the most dangerous failures where they are rarely sudden but slow and built from small defensible choices that each make sense at the time. The safety researcher Sidney Dekker calls this drift into failure, the gradual migration of a system toward the edge caused not by recklessness but by normal competent people responding sensibly to pressure one small step at a time until the organization has quietly moved somewhere no one would ever have chosen to go on purpose.

In the early 1980s a taxi company in Munich ran an experiment by fitting half their fleet with anti-lock brakes, a clear safety upgrade, and leaving the other half on ordinary brakes to watch the accident rate fall, but it did not fall because over three years the cabs with better brakes were in just as many accidents as the ones without. When researchers placed trained observers in the cars they found out why because the drivers with anti-lock brakes drove faster, braked later, cornered harder, and followed the car in front more closely, meaning the safety device worked exactly as designed but the drivers simply spent the safety it created on going faster until the risk settled back to roughly where it started. This is the uncomfortable thing about controls because we add them as if risk were fixed and the control simply subtracts from it, but risk is not fixed and it responds as a safeguard changes how people behave around it and the behavior change quietly eats much of the safety you thought you bought. Inside a company the first thing it produces is a false sense of security because when you put five approvals on a decision each person checks a little less carefully assuming someone else is really looking, and the control that was supposed to multiply scrutiny ends up diluting it as responsibility spreads so thinly across so many people it lands firmly on no one.

On the night of January 27, 1986, the engineers who built the Space Shuttle's rocket boosters told NASA not to launch because a cold front would push temperatures far below anything the O-ring seals had ever flown in and the chief O-ring engineer had already warned in a memo that a failure would be catastrophic and cause loss of human life. The data was not missing and the warning was not vague, it was on the table in the room the night before, yet the next morning Challenger broke apart seventy three seconds after liftoff killing all seven people aboard because what failed that night was not information but the response to it. When the engineers held their ground the contractor's managers asked to go off the line, caucused privately, and pointedly left the engineers out of that final conversation, and a senior executive told the head of engineering to take off his engineering hat and put on his management hat so the no launch recommendation was quietly reversed and NASA was told the data was inconclusive. Most founders assume that if something is broken in their company they will eventually catch it in the numbers, but the uncomfortable truth is that the information almost always exists long before it reaches you because someone on the front line usually knows the deal is slipping, the new hire is not working out, the process is quietly broken, or the best customer is halfway out the door.

On the night of June 1, 2009, an Airbus A330 fell more than thirty thousand feet into the Atlantic with a fully trained crew at the controls and an aircraft that was still mechanically capable of flying, and the reason 228 people did not survive Air France 447 was not a shortage of skill but the quiet collapse of the one thing capable people rely on to think together which is a shared understanding of what is actually happening. The pitot tubes iced over, the autopilot handed back control, and within minutes two competent pilots were working from two different pictures of reality with one acting as if the plane were climbing and one sensing it was falling while the captain who had stepped out for scheduled rest returned to a cockpit he could no longer read in time. This uncomfortable pattern that decades of research in aviation, medicine, and other high stakes fields keeps confirming is that under pressure performance does not break first but communication does, and the leadership meetings where your most consequential decisions get made run on the very same mechanism just with lower stakes and slower consequences because when pressure rises in a room full of capable leaders the first casualty is not effort or intelligence but the shared mental model.