When Confidence Rises Faster Than Reality: The Comfort Matrix
Most organizational failures don’t happen because of missing data, but because confidence grows faster than reality changes.
After every major failure—industrial accidents, cybersecurity breaches, financial scandals—the same question appears: How did no one see this coming?
And the same answer follows: The signals were (usually) there.
What’s less discussed is why those signals didn’t slow confidence, even when they were visible.
The Metrics That Calm Us
Modern organizations are saturated with metrics: dashboards, heat maps, risk scores, maturity models, compliance indicators. These tools are often framed as instruments of foresight and control, but in practice, many of them serve a quieter, more powerful function: they reassure.
Likelihood–impact grids, audit pass rates, green dashboards, closed issues, and “no incidents reported” indicators help organizations feel in control. They reduce disagreement, enable decisions to move forward, and create closure.
There’s nothing inherently wrong with reassurance. Decisions require confidence.
The problem begins when reassurance is mistaken for resolution.
The Comfort Matrix
Make it stand out
Consider the familiar risk matrix: likelihood on one axis, impact on the other. It promises prioritization and clarity. But its real output is often psychological rather than analytical. It answers an unspoken question:
Is it safe to stop worrying about this?
When a risk scores low enough, the conversation ends. When a control passes audit, attention moves on. When nothing bad has happened yet, confidence increases. This is not speculation. Post-incident investigations across industries repeatedly show the same pattern:
Known issues existed
Warnings were raised
Controls were “in place”
Dashboards looked acceptable and confidence continued to grow until reality intervened.
The matrix didn’t fail mathematically. It failed functionally. It produced comfort while unresolved conditions remained.
When Survival Is Misread as Safety
NASA’s Challenger disaster is often cited as a case of “normalization of deviance.” Early shuttle flights returned with O-ring damage, but without catastrophe. Over time, that damage was reclassified as acceptable.
What changed wasn’t the hardware. It was the interpretation.
As long as the shuttle didn’t explode, confidence increased. Survival was allowed to substitute for resolution.
The same pattern appears elsewhere:
Boeing 737 MAX: Certification milestones and “minor change” classifications created confidence while a critical failure path remained unresolved.
BP Deepwater Horizon: Excellent personal-safety metrics masked deteriorating process safety.
Volkswagen: Passing emissions tests created assurance while real-world behavior diverged.
Major cyber breaches: “Controls in place,” “no alerts,” and “patch processes” were treated as evidence of safety while exposure persisted.
In each case, confidence grew not because the problem was solved, but because nothing bad had happened yet.
The Missing Control
Most organizations have sophisticated systems for producing confidence. Very few have systems designed to regulate it.
What’s missing is not more prediction, better scoring, or finer prioritization. It’s a simple but uncomfortable discipline:
Confidence should not increase while unresolved conditions persist.
That idea runs counter to how most metrics are designed. Many reset concern at the end of a reporting cycle. Others allow administrative closure to stand in for real resolution. Silence is often treated as absence, but unresolved conditions don’t disappear just because they’re familiar. Persistence is information. Time matters.
A Different Kind of Metric
There is another class of metric—rarely formalized—that focuses not on ranking risks or forecasting failure, but on preventing premature certainty.
These metrics don’t ask “How likely is failure?” or “What’s the score this quarter?”
Rather, they ask:
What conditions remain unresolved?
How long have they persisted?
What keeps reappearing despite repeated reporting cycles?
Crucially, survival does not reset them; only resolution does.
When an issue recurs without being eliminated, concern increases. When silence persists without proof of absence, confidence is constrained. When controls exist but exceptions never retire, the system remains uneasy.
These metrics are not predictive. They don’t tell you what will fail or when. They don’t prioritize action or optimize resources.
What they do is simpler—and harder to accept:
They prevent organizations from mistaking order for safety.
Why This Feels Uncomfortable
Tools that resist closure are socially disruptive. They slow decisions, they surface tension, and they challenge narratives of progress.
That’s precisely why they’re rare.
Most governance structures reward people who turn dashboards green, close issues, and move on. People who insist that something remains unresolved—even when nothing has gone wrong yet—are often seen as blockers.
And yet, every post-mortem contains the same regret: We should have paid more attention to what didn’t go away.
The Question Worth Asking
This is not an argument against risk matrices, dashboards, or compliance reporting. Those tools serve real coordination needs.
It’s an argument against confusing calm with control.
A useful question for any organization is not:
What does our risk score say?
But rather:
Where does our confidence actually come from?
If confidence is rising because issues are truly resolved, that’s progress.
If it’s rising because nothing bad has happened yet, that’s hope.
And hope, as history keeps reminding us, is not a control system.