A fire watch is a person walking the building. When the fire-protection system is down, somebody covers the gap on foot, once an hour, every hour, because nothing else is watching. The round gets logged. Initials, time, done.
At one nuclear plant those logs came back complete for ten months. Every line filled in, every hour accounted for.
The rounds were not being walked.
The finding there belongs to the regulator rather than to me, so I will use its words. The Nuclear Regulatory Commission concluded that contract workers "willfully failed to conduct compensatory hourly fire watches and willfully falsified the fire watch tour logs by initialing that fire watches were performed with knowledge that watches had not been performed."
What should bother a security executive about that is not the dishonesty. It is that for ten months there was nothing to find. Anybody reviewing that program would have seen a clean sheet, because a complete log looks exactly like a complete log. The only way to test it is to put the paperwork down & go looking for evidence the guard never touched. That is what the plant agreed to start doing afterward: pull the door records, & check them against the rounds.
The other half of the fix was a new logging system, electronic this time, running alongside the paper one. Better paperwork. Still paperwork.
A Known-Known That Is False
In "Hunting the Unknown-Unknown" I wrote about the threat that beats a team because nobody ever thought to look for it. It was never on anybody's list, because it was never in anybody's head.
This is the opposite failure, & in a working program it is the more common one. The data is not missing. It is right there. Specific, dated, signed, & wrong.
That is worse than a gap, & the reason is not complicated. A blank line makes somebody pick up the phone. A complete one gets filed. Nobody has unlimited time to check things, & a confident record sends that time somewhere else. In my experience a green report does something a blank one cannot: it ends the question. That is my professional judgment after twenty years of running & reviewing this kind of reporting, not a research finding.
So the program is not blind. It is looking straight at something it believes, & what it believes is not true.
The Structure That Produces the Record
The easy read is that this is a story about dishonest people, & it is worth taking seriously, because the answer decides the fix. If the problem is individuals, you vet harder & you audit more. If the problem is the structure, honest people under the same pressure hand you the same paperwork, & auditing the paperwork harder just produces more paperwork.
It is the structure. Look at what we actually ask of the person holding the clipboard.
We give them more to do than the shift contains. Then we leave them no way to say so that does not land on them. Nobody sits anybody down & tells them to invent a round. We build a system where the only two choices are to fall behind in the record or to fall behind in the world, & then we grade the person on the record. The Army studied this inside its own ranks & found the same machinery: requirements that outrun the days available to meet them, & no workable way to report the shortfall. What that costs is worth quoting once. An officer's signature & word, the authors wrote, "have become tools to maneuver through the Army bureaucracy rather than being symbols of integrity and honesty."
The receiving end is worse, & the same study found it there too. The people getting those reports knew the numbers were soft. They took them anyway, because the report was the deliverable & the report arrived on time. Both ends knew. The number stayed on the record. That was interview work rather than a survey, so it tells you how the thing happens & not how often.
None of this is new & none of it is military. A social scientist named the rule in the 1970s & the shape has not moved since: the more weight you hang on a number, the more pressure builds to bend it, until the number stops describing the work & starts standing in for it. Measure the report, & you will get reports.
Where It Lives in a Security Program
Once you have the shape, you see it everywhere an organization trusts a self-report. Guard tours are the obvious one & the least interesting. Access reviews, where a manager certifies that everybody on the list still belongs on it. Vendor questionnaires, where a company grades its own security & sends you the grade. Incident logs, where the number of incidents depends on somebody choosing to write one. Drills & after-action reports, describing a rehearsal nobody outside the room watched.
Every one of them ends in the same place. You are holding a piece of paper that describes work you did not see.
The most honest read on how often that paper is wrong comes from auditing, of all places, because auditing is the rare field where a regulator inspects the inspectors & then publishes what it found. A federal oversight board went through a run of audit engagements in 2024, & its staff came back with roughly two in five of them in which the opinion had been signed before the evidence to support it was in the file. That is not fraud & it is not a scandal. It is the ordinary rate at which a professional sign-off outruns the work behind it, in a field that has a regulator, an inspection regime & a public record. Security has none of the three.
Military readiness data fails the same way, & it fails in a way you can picture. When auditors went behind the reported numbers, they found soldiers carried as available for duty who were sitting in jail. That is the entire problem in one line. Nobody reading the record could have found those men. You would have to go look.
Federal contracting has its own version. A university's research arm settled a case over a cybersecurity readiness score it had given the Defense Department, which the government alleged rested on a setup that was not the system actually handling its data. Those claims are allegations only, and there has been no determination of liability. The shape interests me more than the outcome: one number, submitted to win the work, standing in for the thing itself.
Now notice where every one of those comes from. Nuclear plants, federal contracts, the military. Not because those places are worse than the commercial world, but because those are the places where somebody outside is required to look, & then required to publish what they saw. In commercial security this ends with a canceled contract & a quiet non-renewal. Nothing is published, nothing is counted, & the next buyer never hears about it. So when somebody quotes you a percentage for how often a patrol log gets signed for a round nobody walked, they invented it. There is no such number, & the fact that there is none is the point.
Measure the Act, Not the Record
There is somebody else reading this paperwork, & he benefits from it in a way worth saying out loud. A program that reports itself healthy does not chase the thing that looks slightly wrong, because the slightly wrong thing is arguing with a record everybody already believes. That hesitation is time, & time is the only thing an intruder genuinely needs. The firms that get called in after a breach publish their numbers on this every year & the shape does not move: intruders sit inside for weeks before anyone notices, & a large share of victims hear about it first from somebody outside the company. A false green report does not open the door. It lengthens the quiet after somebody comes through it.
So what do you do about it? Three things, & none of them make anybody compliant or satisfy an audit requirement. This is security practice, & these are my recommendations rather than anybody's standard.
- Check in a way that does not run through the person being checked. Not a review of their report. A separate look at whether the thing happened, on a schedule they cannot predict, by somebody who is not graded on the answer. A handful of rounds verified independently will tell you more than a thousand initialed lines.
- Prefer evidence the work creates by itself. Door reads, sensor hits, a scan that carries a place & a time, records that get written whether or not anybody signs. Electronic is not the test, & the fire watch plant proves it. The answer to a log the regulator found had been falsified was an electronic version of the same log. What matters is whether the evidence comes from something other than the person being measured.
- Make bad news cheap. If telling you a round was missed costs more than handing in a clean sheet, you will keep getting clean sheets, & no amount of integrity training will outrun that.
Go back to the fire watch for a moment, because the uncomfortable part is not that logs were signed for rounds nobody walked. It is that for ten months the paperwork was clean, & anybody reviewing that program would have seen it doing exactly what it was supposed to do. The evidence that could have settled the question was being recorded the whole time, in a system nobody had thought to point at it.
So the question I would put to the next executive review is not whether the reports are accurate. Everyone in the room will say yes, & most of them will be right most of the time. The question is what would have to be true for this report to be false, & what evidence we have that the person being measured did not create. At Scopos Strategies, an assessment starts there. We go & check the program itself, the one leadership only ever sees written up in a report, instead of reading the report again.
Take the control you are most confident in, & ask one question about it: what evidence do we have that this work was done, that was not created by the person who did it?
Sources
- U.S. Nuclear Regulatory Commission, Confirmatory Order EA-15-100, In the Matter of All Power Reactor Licensees Owned and Operated by Entergy Nuclear Operations, Inc., et al., issued April 6, 2016; published at 81 Fed. Reg. 25450 (April 28, 2016). govinfo.gov, FR Doc. 2016-09841. The regulator's own findings on fire watch tour logs initialed for rounds not performed between July 2013 and April 2014, the corrective-action commitment to review keycard and door-alarm histories, and the October 2014 implementation of an electronic documentation system alongside the paper log. The order records that no Notice of Violation and no civil penalty were issued, and it confirms commitments reached in an alternative dispute resolution mediation.
- Public Company Accounting Oversight Board, Spotlight: Staff Update on 2024 Inspection Activities, March 2025. pcaobus.org, Staff Update on 2024 Inspection Activities. The aggregate Part I.A deficiency rate of 39% for 2024 against 46% for 2023, the Board's definition of a Part I.A deficiency as an audit report issued without sufficient appropriate audit evidence to support the opinion, and the scale of 171 firms and portions of over 800 public company audits. Two limits carry with it: the document states it represents the views of PCAOB staff and not necessarily those of the Board, and PCAOB footnotes the 2024 rates as estimates because some inspection results were not final.
- Leonard Wong and Stephen J. Gerras, Lying to Ourselves: Dishonesty in the Army Profession, Strategic Studies Institute and U.S. Army War College Press, February 2015. press.armywarcollege.edu, Monograph 466. The structural mechanism this article rests on: requirements that cannot all be executed to standard, non-compliance that cannot be reported, the resulting split between work done to standard and work reported as done to standard, and the signature as a bureaucratic tool. The scale of the mismatch is documented inside it: a 2002 U.S. Army War College study it quotes counted 297 days of required annual training against 256 available training days. It is a qualitative study built on discussions with scores of officers rather than a random sample, so it establishes mechanism and carries no prevalence rate.
- U.S. Government Accountability Office, GAO-15-626, Army Reserve Components: Improvements Needed to Data Quality and Management Procedures to Better Report Soldier Availability, July 2015. gao.gov, GAO-15-626. More than 3,800 inaccurate, incomplete, or inconsistent records identified across all 85,000 soldiers in six units in January 2015, including soldiers listed as available who were incarcerated or medically limited, underneath reported overall non-availability rates of 22% for the Army Reserve and 21% for the Army National Guard. GAO states it analyzed a limited number of availability-related variables, which bounds the finding.
- U.S. Department of Justice, Office of Public Affairs, "Georgia Tech Research Corporation Agrees to Pay $875,000 to Resolve Civil Cyber-Fraud Litigation," Press Release No. 25-1012, September 30, 2025. justice.gov, Press Release 25-1012. The United States' allegation that a summary cybersecurity assessment score of 98 submitted to the Department of Defense in December 2020 was premised on a fictitious or virtual environment applying to no actual covered contracting system, resolved by an $875,000 settlement in United States ex rel. Craig v. Georgia Tech Research Corporation, No. 1:22-cv-02698 (N.D. Ga.). The release states in its own words that the claims resolved by the settlement are allegations only and that there has been no determination of liability.
- Donald T. Campbell, "Assessing the Impact of Planned Social Change," Evaluation and Program Planning 2, no. 1 (1979): 67 to 90. doi.org/10.1016/0149-7189(79)90048-X. The canonical formulation of Campbell's law, that the more a quantitative social indicator is used for social decision-making, the more subject it is to corruption pressures and the more apt it is to distort and corrupt the processes it was intended to monitor. Cited here for the mechanism rather than for any measurement of it; the article text is paywalled.
- Mandiant / Google Cloud, M-Trends 2026, published March 23, 2026. cloud.google.com, M-Trends 2026. Global median dwell time of 14 days for 2025 against 11 the prior year, and 52% of investigated intrusions first detected internally against 43%, drawn from more than 500,000 hours of frontline incident investigations. This is vendor-published research on Mandiant's own engagement population rather than a random sample of organizations, so it describes what one large incident-response practice sees and is not a prevalence rate.
This article was produced with AI assistance. The perspective and security expertise are the author's own.