High velocity is a trailing indicator of impending disaster, a truth Hélène contemplated while her colleagues celebrated a record-breaking month of production pushes. She sat in the third row of the company’s makeshift auditorium, where the air conditioning always hummed at a slightly dissonant pitch, watching the CTO point to a bar graph that omitted the forty-eight security vulnerabilities currently rotting in the backlog.

The slide was bright, aggressive in its optimism, announcing 47 successful deploys in the last twenty-eight days. The “applause” emojis in the remote-hand-zoom-link flared like tiny, digital sparks.

Hélène had spent the morning deleting a thousand-word technical spec for a redundant logging system because she realized, halfway through the final paragraph, that no one would read it until the house was already on fire. It was a strange sensation, the act of preemptive surrender.

Ticket ID #8412

She had written the ticket, ID #8412, titled “Implement rate limiting for password reset endpoint,” back in February. It was now October. For eight months, that ticket had stayed in the “Good First Issue” bucket-a category that, in the local dialect of their engineering culture, meant “important enough to acknowledge, but not urgent enough to fund.”

The company was currently high on the fumes of its own speed. When you move fast, the wind in your face feels like progress. It feels like the market is rewarding your agility, like every feature shipped is a brick in a fortress. But if you are displacing risk instead of resolving it, you aren’t building a fortress. You are taking out a high-interest payday loan from the future.

They look at the 47 deploys and the lack of downtime and conclude that they have finally cracked the code on “efficient delivery.” They have not. They have simply been lucky, and in the world of high-scale software, luck is a finite resource that is depleted by every successful, unvetted push to production.

The Creosote of Software

I spoke recently with Ruby E.S., a woman who spends her winters peering into the soot-stained throats of old New England houses. She is a chimney inspector, a trade that shares more with software architecture than most senior developers would care to admit.

“The fire doesn’t tell you when the chimney is failing; the silence does.”

– Ruby E.S., Chimney Inspector

She explained that creosote-the byproduct of incomplete combustion-builds up in layers, invisible from the living room, until a single spark turns the entire vertical shaft into a blast furnace. By the time you see the smoke coming through the drywall, the structural integrity is already gone.

In our world, the creosote is the bypassed permissions check. It is the hardcoded API key that was supposed to be moved to a secret manager “tomorrow.” It is the ticket #8412 that sits in the backlog because it would have cost three days of development time during a week when three days were not available.

This is where the math of modern engineering usually breaks. We have perfected the art of tracking the visible-sprint points, velocity, commit frequency-while remaining willfully blind to the unpriced risk attached to those metrics. If a team ships ten features but leaves the door unlocked, the dashboard shows ten units of value. It shows zero units of liability.

This asymmetry creates a perverse incentive structure where being early to a problem is indistinguishable from being wrong. If Hélène raises the alarm about rate limiting in February, and the system isn’t breached in March, April, or May, the organization views her concern as “academic.” She is the person slowing down the train for a ghost on the tracks.

But being early is only “wrong” until the clock strikes 3:14 a.m. on the fourteenth of the month.

When the breach eventually happens-and it always happens-the post-mortem will call it an “unforeseen event” or a “sophisticated attack.” It won’t be. It will be the inevitable conclusion of a thousand small decisions to prioritize the visible over the vital. The leadership will look at the wreckage and ask, “Why didn’t we see this coming?” and Hélène will look at ticket #8412, which will still be sitting in the backlog, now tagged with a “Critical” label that arrived exactly eight months too late.

The Transparency of Architecture

The frustration is that this cycle is treated as a law of nature rather than a choice of architecture. We act as if the trade-off between speed and security is a zero-sum game, a sliding scale where you must sacrifice one to gain the other. This is a false binary often perpetuated by the “staffing agency” model of development, where the goal is to throw bodies at a roadmap.

If you don’t have that direct line to the engineer-if there is a layer of management between the person writing the code and the person making the business decisions-the truth about risk will always be diluted. It will be “summarized” into a status report that uses words like “on track” and “minor technical debt.”

The Price of Silence

I remember a project I worked on roughly six years ago. We were building a fintech platform for a Seed-stage startup. The pressure to launch was immense. Every week, the founder would ask if we could skip the automated integration tests “just for this release” to hit a marketing deadline.

He viewed those tests as a luxury, a tax on his speed. He didn’t see them as the insurance policy they were. It took us three months of constant, quiet advocacy to convince him that the “slow” way was actually the only way to stay in business. He eventually relented, not because he understood the technical risk, but because he trusted the lead engineer who sat on every call with him.

You can type ten thousand words an hour, but if they don’t form a coherent narrative, you haven’t written a book; you’ve just made a mess. Software is the same. A high deploy count is a measure of activity, not progress. If those 47 deploys in Hélène’s all-hands meeting were built on a foundation of unaddressed vulnerabilities, then the company is actually moving backward.

The real challenge is to change what we celebrate. We need to find a way to applaud the Hélènes of the world-the ones who keep the “boring” tickets from rotting. We need to recognize that the person who insists on rate limiting is the person who is actually protecting the company’s velocity in the long run.

Because nothing kills velocity faster than a 3 a.m. emergency that requires the entire engineering team to stop everything and rebuild the “house” while it’s still smoldering. You either pay in the form of a slightly slower development pace today, or you pay in the form of your reputation, your data, and your sanity tomorrow. The price is the same, but the timing is everything.

The ticket that saves the company usually dies in the silence of a successful demo.

We must stop pretending that the silence is free. We must stop looking at our dashboards as maps of the future and start seeing them for what they often are: a record of how much we have borrowed from a future we are not yet prepared to inhabit. If the only thing your team tracks is how fast things go out, you aren’t managing a product; you’re managing a countdown.

And as Ruby E.S. would tell you, the worst time to find out your chimney is clogged is when you’ve already lit the match.