The fragility you can already see

Every year around now I walk the fields before the first proper autumn storm rolls in off the sea. Not for anything romantic. The horses have leaned on something they were not supposed to lean on, and there is a post near the back fence that has been quietly rotting since spring. I know the one. I have known about it for months. It looks completely fine from the kitchen window, and it will be the first thing to go the moment the wind gets serious.

That post is more or less the whole article.

I dragged Taleb into the last piece, the one about build versus buy and the muscle you decide not to build. I want to stay with him for one more, because I think I rushed past the actually useful bit. Anti fragility gets quoted to death, usually by someone selling a resilience workshop with a nice deck. The part that I think helps is less glamorous and it’s via negativa. You cannot forecast which shock is coming, so stop trying to. Go and find the fragility you can already see, and remove it.

Not the storm, the post

We burn an enormous amount of energy in enterprise IT trying to predict the storm. Risk registers, scenario planning, the annual “what keeps you up at night” session where everyone dutifully says “ransomware” and then goes back to their desk. And I get it, some of that is genuinely worth doing. And AI may make that a bigger stick then I now currently think. But my worry is that it flatters us.

Trying to look competent, this image always pops up in m head. Sorry Rita.

Forecasting the shock feels like strategy. It feels like control. You get to stand at the window and look competent while pointing at the horizon.

Meanwhile the rotten post is right there. I walked past it this morning with my dogs.

You know the ones. The one person who actually understands the billing integration, and yes they are almost at retirement age. The vendor contract with no exit clause and a renewal in March. The TLS certificate whose only renewal reminder is a recurring event in someone’s personal calendar. The batch job that has run every night since 2019 on a laptop under a desk in an office that half the company forgot you still rent. The “temporary” workaround from a bad week that is now become load bearing. None of those need a forecast. You do not have to know which one fails first. You only have to be honest that you can actually see a lot of them.

I think the reason we keep staring up at the storm instead of down at the post is that the post is embarrassing. The storm is nobody’s fault, it is weather, it is the market, it is a zero day. The rotten post has your name on the commit. Looking at it means admitting you have known and done nothing, which is a much less comfortable meeting than the one about hypothetical ransomware.

Walk the fence line

So here is the thing I would actually do, and it is not a heat map, although I love those. A risk assessment gives you a lovely coloured grid and a warm sense of accomplishment and changes nothing. I mean a literal walk along the fence line, naming out loud the things that are obviously weak. The single point of failure that turns out to be a single thing. A human being. Or the dependency you genuinely could not survive losing next quarter. The system everyone routes around because “it’s fragile, don’t touch it”.

That last one is the tell, by the way. If people are already tiptoeing past a system, being careful with it, warning the new hire not to poke it, that is your rotten post! Nobody tiptoes past the sturdy fence. That learned gentleness is a great signal.

My rather long winded point is that most resilience work is simply aimed at the wrong distance. You are scanning the horizon when the answer is under your boots. Remove one visible fragility a quarter, actually remove it, and you will do more for your real chances of survival than any amount of scenario planning about a shock you cannot name yet. It is not clever work, it is fence work. It holds the horsen in.

And it links straight back to the buy decision from last time. When you buy out your own ability to build a thing, that is not a fragility that surprises you three years later when the vendor pivots. It is a fragility you can see the afternoon you sign. It is already visible. You just filed it under “cost saving” instead of “post I will regret”. Or like I learned from a Salesforce colleague: a future-me problem.

I am not saying you can see everything. Some shocks really do come from nowhere, and the whole point of this via negativa is that you admit you cannot predict those, which is exactly why you spend your energy on the ones you can. The unknowable storm is not your job. The rotten post probably is.

The horses, for what it is worth, have no idea which night the wind comes either. They lean on the fence anyway, because leaning is what they do, and the post either holds or it does not. I finally fixed the first of the posts last weekend. There is another one by the water trough that I am pretending I have not noticed yet. It is doing okay-ish. For now.