Blind Spots & The Shadows They Cast

Why you will never find your blind spot by looking for it

A boss of mine, back when I was new to the security business, had a line he used whenever someone got too pleased with themselves. “After twenty years in this game,” he’d say, “I know every trick in the book… except the one they’re using right now.”

I’ve thought about that line for most of my career. It is the whole problem in one sentence.

Blind spots are, by definition, the things you cannot see. I can tell you what mine were. I cannot tell you what they are.

The moment I can name one, it stops being a blind spot and becomes an issue. Or maybe a risk, which is a much easier thing to manage. Risks go on a register. Blind spots go on the incident report, six months later, in the past tense.

This is the terrain Nassim Taleb was mapping with Black Swans, and it’s the reason the phrase “preparing to fight the last war” has survived so long. We know what happened last time. We do not know what we’re actually being asked to prepare for. Ukraine has been quietly rewriting the manual on that for a few years now, and AI is doing something similar to cybersecurity while most of us are still arguing about the policy wording.

Most blind spots are harmless. Some of them eat you.

Plenty of what we don’t see about ourselves is benign. Habits, tics, small social clumsiness. It sits there for a lifetime and costs nothing.

The risk management question is narrower and less comfortable: what is the thing that is going to bite me that I currently cannot see?

One of the secrets of my success, such as it is, is that I’m constantly looking for my blind spots. Sometime around the age of 35 or 40, after an epiphany or two came out of the blue, I started looking for them deliberately. I couldn’t even tell you what those epiphanies were now; they were so long ago. But they sowed the seed of an idea.

It’s not complicated. Blind spots are things that can hold us back, but equally, they can offer extraordinary opportunities for rapid improvement.

Societal blind spots

Take the pandemic as an example, because it’s recent enough that everyone has an opinion and distant enough that we can be honest about it. The risk that was visible, and had been visible for years, was biological. We knew pandemics happened. We knew laboratories were conducting gain-of-function research. We knew biological weapons existed. None of that required much imagination.

Some of the damage that followed, however, came from systems sitting beside the biological risk. Procurement conducted at extraordinary speed. Vaccine trials conducted at population levels. Contracts awarded while normal oversight was relaxed. Lockdowns that varied with jurisdictions, not with risk. Fraud exploiting emergency programs. Those risks were foreseeable too, but they received considerably less attention while everyone was staring at the virus.

There was another vulnerability that was harder to see: institutional trust.

Trust rarely appears on a risk register as a control, but in an emergency that’s exactly what it is. Governments depend on millions of people voluntarily accepting advice, changing their behaviour, tolerating restrictions and believing information they cannot independently verify. Spend that trust carelessly during one emergency and you may discover that you don’t have enough of it when the next one arrives.

And there were shadows. Declining voluntary compliance. Increasing reliance on enforcement. Growing hostility towards institutions and experts. Official explanations being received with suspicion rather than benefit of the doubt. Distrust spreading beyond public health into institutions that had little to do with the original decisions.

None of those things was institutional trust. They were its shadow.

That’s the pattern I want to explore here. Sometimes the blind spot isn’t the exotic threat. It’s an ordinary dependency sitting beside it that nobody recognised as important until its behaviour started changing. You don’t necessarily see the thing itself. But if you’re paying attention, you may see the shadow it casts.

So how do you find something you can’t see?

Not by looking for it. That’s the trap. You cannot inventory the unknown, and every “unknown unknowns workshop” I’ve ever sat through eventually produces a list of known unknowns with more confident adjectives.

Here’s the analogy I use instead.

When you’re driving, if there is a car in your blind spot, you cannot see it in your mirrors. Nor can you see it out of the corner of your eye. If you change lanes on the assumption it isn’t there, you find out that it is. Oops.

Here’s the nuance, though: you might not be able to see the car, but you can see evidence of its existence.

Blind spots: The shadow is the clue

You might, for example, see a pedestrian at the curb who is clearly about to step out, then doesn’t, because they’re tracking something you can’t. You might see their gaze fixed on something — the car in the next lane, just outside your field of vision.

More commonly, you might simply see, at the right angle of afternoon sun, a shadow on the road beside you or in your side mirror. A shadow moving alongside yours that belongs to a motorcycle or car you can’t locate. At night, in fog or rain, you might see an extra wash of light reflecting off a road sign, or lighting the road surface that your own headlights don’t account for.

None of those things are the car. All of them are evidence of the car.

The social and human version of this is familiar to anyone who has worked across cultures. I’ve been the guy who said something clumsy, or stood too close, or made a gesture in a meeting that meant something I did not intend. I never once detected the mistake directly. What I detected was a temperature change in the room. Someone’s shoulders. An invitation that didn’t come.

The mistake is invisible to me by construction, because if I understood the offence, I wouldn’t have committed it. The reaction is not invisible at all, provided I’m watching for it rather than talking.

The workplace version

Stop asking, “What am I missing?” Start asking, “What clues might be visible if I am missing something?”

Some tells that might be worth taking seriously:

• Unexplained turnover in one team. People rarely file a report saying, “My supervisor is a problem.” They just leave, one at a time, with polite exit interviews. A resignation pattern is a psychosocial hazard casting a shadow.

  
  

• Documentation that doesn’t quite reconcile. Not obviously wrong, just persistently a bit off. Invoices that need explaining. Approvals that arrive out of sequence. Fraud is very good at hiding. Friction in the paperwork is much worse at it.

  
  

• A facility that never reports incidents. This is my favourite one because it reads as good news on the dashboard. A site with zero incidents in three years does not necessarily have zero incidents. It may have a reporting culture where incidents have been normalised into background noise, and you are flying blind over the one location you’re least worried about.

  
  

• A server bill that doesn’t match its peers. If one platform’s network traffic or monthly bill is materially out of line with comparable systems and nobody can explain it, that’s worth a look. Data exfiltration is expensive to the victim before it’s visible to the victim.

You are not going to find the open port by staring at the network diagram. You are not going to find the person walking stock out the back of the warehouse by reading the inventory policy. In a conflict, you don’t find the leak by auditing the classification markings; you find it because the other side keeps arriving early.

You find the shadow. Then you go looking for what’s casting it.

That’s the discipline. Watch for effects you can’t account for, and treat “I can’t explain that” as a finding rather than an annoyance. Every organisation has a car sitting in its blind spot right now. Mine included. The only real question is whether you notice the light on the road before you change lanes.

The never-ending hunt for blind spots

With the hunt for my own blind spots now well into its third decade, the epiphanies come less often, but what I do know is that I still have blind spots. I always will.

Learning to look for the shadows they cast has given me some of the most valuable lessons of my life. It has helped me recognise limiting beliefs, change behaviours that weren’t serving me, and see things I was doing that were getting in the way of my work, my judgement and my relationships.

That’s really what I wanted to leave you with. Don’t waste too much time trying to look directly into your blind spots. And definitely don’t ignore the possibility that they’re there. Eventually, the ones that matter have a way of biting you.

Look instead for the shadows they cast: the feedback that doesn’t make sense, the reaction you didn’t expect, the pattern that keeps repeating, the relationship that isn’t working, or the outcome that doesn’t fit your explanation of how the world works.

When something doesn’t add up, resist the temptation to explain it away. Get curious about it.

You may not be able to see what’s in your blind spot. But if you learn to recognise its shadow, you can still find it.