Why learning from failure is the key to lasting improvement
Available on
Audible & Amazon
Author
Matthew Syed
Behaviour Stage
Culture
Overview
Black Box Thinking explores why some organisations learn, adapt, and improve after failure... while others repeat the same mistakes again and again. Using examples from aviation, medicine, sport, and business, Matthew Syed argues that progress depends not on avoiding failure, but on how openly and intelligently we respond to it. Environments that punish mistakes create silence, denial, and blame; those that examine failure without fear create continuous improvement.
At its core, the book is about culture. It shows how psychological safety, honest feedback, and data-driven reflection enable learning at scale. Where mistakes are hidden or minimised, risk compounds. Where they are surfaced and analysed, systems get stronger. Black Box Thinking reframes failure as information... something to be studied, shared, and used to prevent future harm.
Why this matters for security behaviour
Black Box Thinking is directly relevant to security behaviour because most breaches are not caused by a single catastrophic error, but by small, repeated mistakes that were never examined properly.
In many organisations, security incidents are met with blame, embarrassment, or silence... discouraging people from reporting near misses or admitting uncertainty. This creates the perfect conditions for the same behaviours to repeat. By contrast, a “black box” approach treats incidents, mistakes, and near misses as learning opportunities, reinforcing the importance of open reporting, shared responsibility, and continuous behavioural improvement rather than punishment or compliance theatre.
Key Takeaways
- Failure is data, not a disgrace
Mistakes only become dangerous when organisations refuse to examine them honestly
- Blame kills learning
Cultures that punish error encourage silence, denial, and repeated risk.
- Near misses matter as much as incidents
Small warning signs are often ignored until they escalate into major failures
- Psychological safety enables better security behaviour
People are more likely to report issues, ask questions, and challenge risky decisions when they feel safe to do so.
- Systems fail more often than individuals
Security incidents usually reflect systemic weaknesses, not individual competence
- Learning organisations improve faster than compliant ones
Continuous feedback and reflection outperform static rules and policies.