Trust/Risk Ratio T_r · Ch 12(Traffic volume × uptime) ÷ incident severity. Run silent until the math is undeniable, then push the alert.
Worked example — Running silent in one department
Four months live with a single team: 200,000 requests a day, 120 days of uptime, and two brief incidents you'd score at 5 severity between them.
It came out at 4,800. Yellow — not yet.
Hold the same severity to 260 days and it reads 10,400: green, ready to be somebody's primary. Then push the alert. You only get to make the argument that turning you off is the dangerous move once, so wait until the arithmetic is boring.
▸ ZERO's shadow system, the Friday
Your turn — change one number
Result 4,800
Yellow. Keep running silent. The math isn't undeniable yet.
Book's benchmark: 🟢 > 10,000 (ready for primary) · 🟢🟢 > 100,000 (System of Record) · 🔴 < 100 (stay in shadow).
⌁ ask what this number means for me From the module
Friday 5:07 PM, holiday weekend, skeleton crew. ZERO's shadow system detects a coordinated supply-chain attack the legacy misses — $4.2M exposure. 15 seconds: stay safe in shadow, or reveal and save MegaCorp. She touches the implant scar and pushes the alert. Attack contained. BISHOP arrives — badge perfectly straight for the only time. CIO: "How fast can you start?" Risk inverts.
Re-read The Invasion Plan →