Assurance · Workforce Capacity · Soft Exhaust

Green by Heroics: The Safety Margin Your Dashboard Can't See

A control can report green while people silently subsidise it. Measure the obligation-to-capacity ratio — and treat amber as a resource contract, not a performance verdict.

By Scott Farrell, LeverageAI  ·  For risk, cyber, operations and assurance leaders

There is a pattern I keep seeing in regulated environments. A control family is green. Patches are closed. Reviews are signed. Service levels are met. The board pack is clean. And the people who produce that green are working longer hours, carrying more systems, compressing every review, and not turning up to the meetings that used to make the assurance real.

Nobody is lying on the dashboard. The obligation was met. What the dashboard cannot say is the more important sentence: the designed operating model still has sufficient capacity.

Those are not the same claim. They only share a colour.

The wrong response to the soft signal underneath — after-hours coordination, shortened review notes, the same two specialists on every critical thread — is staff surveillance: measure the people harder. That is the anti-human read of AI and operational telemetry. The pro-human read is simpler, and harder to staff for:

The exhaust shows that the organisation's declared level of assurance is being sustained by hidden human effort. The process needs more capacity, assistance or redesign — not a closer performance score.

I call the failure mode Green by Heroics. I call the missing instrument Human Reserve Margin. Together they force a companion rule onto the Workforce AI Compact: when obligation intensity rises, capacity must be reviewed — whether the intensity came from AI throughput or from a threat and regulatory cycle that simply will not wait.¹

The pressure pattern: obligation up, headcount flat

Start with Australian banking infrastructure as a sector-level shape, not a named-bank indictment. Public reporting already describes the squeeze. Attack paths that begin with exploitation of public-facing applications rose sharply year-on-year in IBM's 2026 X-Force work, with financial services among the most targeted industries and continuous vulnerability hunting and patch governance recommended over purely periodic security review.²

Then frontier models changed the defender's clock. ASD has reported that advanced models can chain multi-step simulated corporate intrusions and sharply accelerate vulnerability discovery. Its advice is not only "patch faster." It is that the response cannot be left to cyber defenders alone — process and organisational change are required.³ ASIC called for an urgent cyber uplift across financial services as AI accelerates threats.⁴ APRA has said governance, assurance, information-security and operational-resilience practices are not keeping pace, and that frontier models require a step-change in cyber practice.⁵

On 22 June 2026, Five Eyes cyber agencies put a calendar under the rhetoric: the timeline for transformation is "not years, it is months," and leaders should empower cyber leaders with authority and resources.⁶ That second word is load-bearing. Authority without resources is a speech. Resources without authority is a budget line that cannot change the work.

Meanwhile the maturity models tighten the window. ASD's Essential Eight expects critical or actively exploited vulnerabilities on exposed systems to be patched or mitigated within forty-eight hours, with scanning cadence measured in days and weeks rather than quarters.⁷ ASD's 2024–25 threat report recorded financial and insurance services among the most frequently reporting non-government sectors, with incident response and malicious-activity notifications rising sharply year-on-year.⁸

Put the sequence in one line:

Attack velocity rises. Vulnerability discovery accelerates. Regulatory expectation rises. Patching windows contract. Headcount assumptions stay where they were when the threat was slower.

That is the pattern I have watched play out in banking IT and support teams: more tests, more patches, cycle times compressed from months toward weeks or days — without a corresponding increase in people. Everyone works more hours. Shifts stretch. Behaviour changes. Disagreement and quiet panic rise in the operational channels. And the formal status stays green, because the obligation is still being met by people spending themselves as reserve.

Public sources will not give you a neat table of overtime at any particular Australian bank. That local operational detail is ordinarily invisible. That invisibility is the argument. The global workforce picture is at least consistent with the shape: ISC2's 2025 study found large shares of organisations without budget for adequate cyber staffing, respondents overworked or exhausted by threat pace, and process oversights attributed to skills shortages.⁹ Attack intensity and constrained capacity can coexist for a long time before the dashboard admits it.

Green by Heroics

Green by Heroics is when a process, control or service reports green because employees are silently contributing unsustainable additional labour, attention and personal resilience.

The formal report records what institutions know how to count:

• patches completed
• incidents closed
• service levels met
• controls performed
• milestones achieved
• reviews signed off

The soft layer — the emails, threads, meeting notes, handover friction and review artefacts that BI for Soft Data treats as organisational source code — can reveal something else entirely:¹⁰

• nights and weekends becoming normal
• more people pulled into each issue
• repeated emergency coordination
• review notes getting shorter
• unresolved questions carried forward
• temporary workarounds accumulating
• fatigue and competing-priorities language rising
• experienced staff covering several roles
• approvals arriving at the end of shifts or just before deadlines
• fewer independent reviewers
• growing reliance on one or two load-bearing specialists
• staff saying "we got it done" rather than "the control is working"

The dashboard sees compliance. The soft layer sees the human subsidy underneath compliance.

This is adjacent to — not a rehash of — the green-formation work in Elastic Assurance. One of those formation modes is compensated green: status produced by people filling gaps the design did not fund.¹¹ Green by Heroics is that mode made operational for capacity leaders. It is also what the Institutional Failure Radar is designed to sense without scoring people — behavioural telemetry around a control, not a performance ranking of the humans holding it up.¹²

Designed green vs compensated green

Before you instrument anything, lock the distinction. Two greens can look identical on a status board and mean opposite things about the operating model.

If your governance system cannot tell these apart, it will keep rewarding the people who are quietly becoming the institution's unreported safety margin — until they leave, get sick, or make the first mistake that exhaustion was always going to buy.

Human Reserve Margin

For critical-infrastructure operators, the cleanest metaphor is already trusted on the engineering side of the house.

Human Reserve Margin is the sustainable capacity remaining after a team has delivered its expected workload, maintained quality, handled normal variation, and preserved enough contingency for an incident.

A power system can supply every megawatt of current demand and still be unsafe if it has no reserve for the next contingency. The lights are on. That does not mean the system has adequate margin. Human capacity works the same way. A team can meet every KPI while its reserve approaches zero.

The last row is the managerial failure mode that looks like governance: status goes amber, so leadership adds reporting, reviews and oversight — without adding people, time or authority. That is how you get amber-level scrutiny on green-level resources. It guarantees hidden work and shallow assurance.

What to sense: obligation-to-capacity, not "who is slow"

The system should not ask who is working too slowly. It should ask:

Where has the obligation-to-capacity ratio changed without a corresponding change in resources?

Signals fall into four families. None of them is a person score. Together they support a capacity hypothesis at team or function level — privacy-preserving, aggregated, aimed at the control environment.

Work expansion

• higher frequency of security, safety or assurance requests
• shorter required completion windows
• more systems and assets in scope
• increased testing depth
• more regulatory or executive reporting
• increased third-party coordination

Effort expansion

• activity moving outside normal hours
• growing meeting and messaging volume around routine controls
• more handoffs and escalations
• repeated calls for assistance
• the same specialists appearing across unrelated incidents
• increasing interruption of planned work

Quality compression

• shorter review comments
• repeated boilerplate approvals
• fewer counterarguments
• declining evidence depth
• deferred remediation
• temporary exceptions renewed rather than closed
• formal reports getting cleaner while operational conversation gets more anxious

Human-capacity deterioration

• sustained overtime at team level
• leave cancelled or deferred
• vacancies unfilled
• increased contractor dependence
• key-person concentration
• training and preventative work displaced by urgent work

That fence is the same moral geometry as the Institutional Failure Radar: signals generate questions about systems, not accusations about people.¹² The Institutional Linter can still ask whether the codified procedures contradict each other; the radar can still ask whether deliberation is deforming; this instrument asks whether the people are being spent as free contingency.¹³

Worked example: obligation-to-capacity and the amber contract

Here is the artefact in the shape a responsible owner can actually use. The numbers are illustrative for a mid-sized OT or infrastructure-adjacent security control family — not a claim about any real team's headcount. The structure is what matters.

A crude obligation-to-capacity index for the period:

Relative obligation load ≈ scope growth × event frequency × inverse window
≈ 1.38 × (22/8) × (10/2) ≈ 19× the designed intensity on the dimensions that moved — while funded capacity stayed at 1.0×.

You do not need a precise scalar to act. You need a threshold rule the organisation pre-commits to. Example rule set:

• Watch: any two effort-expansion or quality-compression signals sustained for four weeks while formal status remains green.
• Amber (resource contract): funded FTE unchanged while either (a) in-scope systems rise >20% and urgent events double, or (b) after-hours volume stays >4× baseline for six weeks with review-depth collapse and key-person concentration.
• Red (concealed): green formal status with no backup for critical specialists and preventative work deferred twice — structurally red even if the light is green.

Under that rule, the table above is amber — while the dashboard is still congratulating itself.

That packet is pro-human and pro-safety at the same time. It treats amber as a resource contract:

The operating conditions have moved outside the assumptions under which this team was staffed.

Most organisations still treat amber as a performance judgement — "the team is falling behind." That reading produces scrutiny without capacity. The contract reading produces help, redesign or explicit de-scoping. Only one of those preserves assurance quality under sustained pressure.

Where Green by Heroics hides in critical infrastructure

Generalise beyond banking. A critical-infrastructure operator running a more complex grid, an expanded capital programme, tighter cyber expectations and scarce specialist labour will generate the same shape wherever obligation outruns the staffing model. Likely human-reserve hotspots include:

• control-room and power-system operations
• protection engineering
• operational technology cybersecurity
• outage planning
• commissioning and testing
• field maintenance and emergency response
• system-strength modelling
• project safety assurance
• contractor oversight
• regulatory and technical submissions

The dangerous condition is not that these teams fail to deliver. It is that they continue to deliver while complexity, cyber threat, capital delivery and assurance demand all rise — and the staffing assumptions from a simpler era stay on the books. That is exactly where Green by Heroics forms: green lights, thinning reserve, nobody officially aware until the resignation letters or the incident.

Companion principle for the Workforce AI Compact

I have argued elsewhere that AI is anti-staff by default because organisations automatically convert new cognitive capability into higher throughput, flat headcount and tighter monitoring — the Extraction Reflex — unless a Workforce AI Compact intercepts it with enforceable triggers.¹ The Compact's north star is still right: AI should buy time before it buys headcount.

Green by Heroics extends that doctrine past AI deployment itself. The same extraction mechanism fires when an external obligation intensifies:

threat or regulatory intensity ↑ → scrutiny ↑ → cadence ↑ → headcount flat → human reserve consumed

So add a companion principle:

Obligation increases must trigger capacity review.

Not only: "AI-generated throughput rises by 15%, therefore review workforce impact." Also: "Required assurance intensity, frequency or scope rises materially, therefore revalidate the staffing and capability model."

A pro-human assurance system therefore monitors three things together:

1. Obligation load — what the organisation is demanding of a control family.
2. Assurance quality — how deeply and independently the work is still being done.
3. Human reserve margin — how much sustainable capability remains.

A green control with collapsing human reserve becomes amber for capacity purposes even before the control fails on the formal board. That is the sensing the dashboards were never built to do — and the reason soft exhaust, read at machine scale, earns its keep as safety infrastructure rather than as a people-analytics product.¹⁴

Later work in this series will take governance design further — including a governance barbell for where to put weight, an intent compiler for turning policy into executable checks, and a cognition scarcity audit for where attention itself is the scarce resource. Those pieces are not yet live; the point here is narrower and actionable now: instrument reserve, and wire amber to help.

What to do on Monday

If you do nothing else, stop congratulating green that was purchased with unpaid reserve. The employee is not the safety system. The employee is what you are burning when the safety system was never sized for the obligation you now demand.