Anxiety Kernels
Most warnings arrive in time, and reach nobody with a reason to act.An anxiety kernel is a small written rule that prices the harm, names an owner and keeps the warning open until someone has handled it.Anton Chigurh, No Country for Old Men — What was the rule for?
Subtitles on the image read: “If the rule you followed brought you to this, of what use was the rule?”During the Optus Triple Zero outage of 18 September 2025, two alerts fired, the post-change graphs showed call failures rising, and five callers described the fault correctly. None of it reached anyone with the authority and a reason to act.
An anxiety kernel decides in advance who that is and how fast they must act. It has four parts, none of them new.
- Watch
- One stream the organisation already has: alarms, call records, tickets, spend.
- Price
- The harm, as a cost of delay in a shared unit (here, dollars per hour), with the source of the figure recorded beside it.
- Route
- To a named owner, at a severity the price sets, so nobody decides at two in the morning whether this is worth someone's sleep.
- Hold
- One episode, kept on that person's desk until it is handled.
Kerry Schott AO reconstructed the night in an independent review for the Optus board, dated 12 December 2025. drksci had no part in it.
Schott found mistakes that "can only be explained by a lack of care about a critical service", and most of them were made before any alert could fire. A kernel would not have prevented those. It applies to the alerts that did fire and went nowhere.
Warnings recorded by the independent review
| Time | Signal | What happened |
|---|---|---|
| 00:20 | Operations-centre alert, three minutes into the work | Linked to the upgrade and not investigated |
| 00:47 | Second alert, raised as an incident by Optus | Asked whether it related to the change; no further investigation |
| 02:40 | Post-change graphs show call failures rising | Not noticed |
| All night | Triple Zero call monitoring | Used national totals, too coarse to show a regional failure |
| 10:13 to 14:11 | Five calls to the Optus contact centre, each correctly describing the fault | Treated as device or local faults; none escalated |
| about 13:15 | SA Ambulance tells Optus | Investigation begins; major incident declared at 13:51 |
Every alert and every call reached someone, and none went any further.
If the rule you followed brought you to this, of what use was the rule?
Anxiety, here, means holding a warning when acting on it gets a person refused or blamed. People stop acting, and from outside the unanswered warnings look like nobody noticed. A kernel makes acting the default and keeps it cheap.
Three synthetic personas, Support, DevOps and Owner, work the same bad night twice in an invented small business. In the aversive run every action is refused or blamed. In the reinforced run every action is backed.
Method · one variable, two arms
- Varied
- Reinforcementapplied to each action
- Agents
- 3 synthetic personasmodel: not recorded
- Load
- 6.0 / hincoming work, in energy units
- Run
- 24 h96 steps of 15 min
- Capacity
- 90 · 120backlog tops the wall · the towers
- Kernel
- every 4 hdrawn over the recording
- Seed
- 20261003one run per arm
- Status
- Simulationseeded, not measured
Same night, two runs
Each post is a kernel firing: priced, handed to someone, then handled or left overwhelmed.
Acting is aversive
Each attempt is refused or blamed and changes nothing; initiative falls, avoidance sets in. Sisyphean.
Acting is reinforced
Each attempt is backed and the ticket closes, so initiative holds and acting stays cheap.
Grey posts: overwhelmed tickets nobody took. Water: the backlog of unhandled work. Last column: Telos coherence.
Under each plate, every refused action lowers initiative and raises avoidance, until doing nothing is the cheapest option. The last column is the Telos System's coherence signal.
So the decision to act has to be written down before the night.
A kernel is a few lines anyone can read and argue with. The Triple Zero kernels below are an illustration written for the Optus night. None would have fixed the fault.
A life-safety failure is top severity by definition. The first rule watches by state because detection has to match the grain of the failure. Optus missed that in three ways.
- In space
- Optus monitored Triple Zero with national totals, and a failure confined to one region barely moved them.
- In time
- By 02:40 the post-change graphs already showed call failures rising, and nobody was looking. A check has to run at the pace of the change it is watching.
- Activity without progress
- Between 10:13 and 14:11 five callers described the fault correctly, and each call was treated as a device or local fault. Many reports with no change in state are a signal too.
Pricing ranks alerts by what an hour of delay costs rather than by how often they fire. It also lets anyone argue precisely: raise $100 an hour to $250 and give the reason.
Severity ladder
| Severity | Cost of delay | Who is told | Within | Repeat |
|---|---|---|---|---|
| SEV1 | ≥ $100/h | executive on call, duty manager, owner | 5 min | every 30 min |
| SEV2 | ≥ $25/h | duty manager, owner | 15 min | every 1 h |
| SEV3 | ≥ $5/h | owner, head | 1 h | every 4 h |
| SEV4 | ≥ $0/h | priority list | 1 d | — |
Most alerting skips the holding step and fires afresh on every repeat, until people stop seeing a red light that is always on.
Life of one signal
Asimov called prejudice a wonderful thing for saving a man the trouble of thinking, because it supplies conclusions ready-made. Every alert rule, kernels included, is a ready-made conclusion of that kind. Somebody decided in advance what normal looks like. On a dashboard, a well-kept rule and a stale one look the same.
A rule becomes prejudice when nobody remembers who set it, on what evidence, or when it was last tested. "Alerts during planned work are expected" is usually a reasonable rule. On 18 September 2025 it was applied to the two alerts that mattered most. The guard is to give each rule a sourced cost and a date, and to agree in advance how it will be judged.
Well-kept rules still add up. Toggle in the other jobs a business now watches, and the open warnings pass what one person can attend to long before any of them is serious.
One worry, then the rest
Monitoring is usually bought all or nothing, the full operation or finding out afterwards. Optus had the full operation. Between the two sits a bedrock baseline, the smallest set of costed rules that stays on, cheap enough that removing it would have to be a deliberate decision.
Priced warnings can be totalled in the accounts, which somebody always reads.
Nothing in this section has been tested on a real P&L. The conjecture is that operational and security risk was never managed properly because managing it took too much attention, and probably still does.
Added together, kernel prices become rolling scenario estimates within the P&L. Each kernel's median cost, its P50, lands in a named account in the months it is likely to fall. Its P10 to P90 band, which holds four outcomes in five, widens the forecast around it.
Kernel prices in a forecast P&L
- Risk-adjusted, P50
- A$64.8m
- P10 to P90
- A$58.7m – A$66.8m
- Before kernels
- A$70.6m
- Budget
- A$72.0m
- Budget
- Before kernels
- Risk-adjusted P50
- Kernel P50 cost
- P10 to P90
Illustrative organisation · not any real company · forecast P&L FY27 · A$'000 · as at 30 Sep 2026 · debits in brackets
| A$'000 | JulAct | AugAct | SepAct | OctFcst | NovFcst | DecFcst | JanFcst | FebFcst | MarFcst | AprFcst | MayFcst | JunFcst | FYA+F | P10 – P90FY |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Revenue | ||||||||||||||
| Service revenue | 39,016) | 39,646) | 38,527) | 39,919) | 39,096) | 36,954) | 36,707) | 39,137) | 40,483) | 39,053) | 39,401) | 40,461) | 468,400) | |
| Projects & equipment | 3,224) | 3,878) | 5,118) | 4,361) | 5,371) | 3,680) | 2,615) | 4,196) | 5,403) | 4,791) | 4,285) | 6,878) | 53,800) | |
| Customer creditsK1 K2 K3 K5 | (248) | (370) | (291) | (259) | (251) | (307) | (256) | (292) | (389) | (312) | (305) | (320) | (3,600) | |
| Total revenue | 41,992) | 43,154) | 43,354) | 44,021) | 44,216) | 40,327) | 39,066) | 43,041) | 45,497) | 43,532) | 43,381) | 47,019) | 518,600) | |
| Cost of service | ||||||||||||||
| Network & carriage | (10,967) | (10,998) | (10,981) | (11,130) | (11,077) | (10,896) | (10,646) | (10,987) | (11,107) | (11,006) | (10,964) | (11,141) | (131,900) | |
| Project delivery | (2,079) | (2,907) | (3,326) | (3,183) | (3,830) | (2,530) | (1,907) | (2,896) | (3,629) | (3,574) | (3,016) | (4,823) | (37,700) | |
| Total cost of service | (13,046) | (13,905) | (14,307) | (14,313) | (14,907) | (13,426) | (12,553) | (13,883) | (14,736) | (14,580) | (13,980) | (15,964) | (169,600) | |
| Gross margin | 28,946) | 29,249) | 29,047) | 29,708) | 29,309) | 26,901) | 26,513) | 29,158) | 30,761) | 28,952) | 29,401) | 31,055) | 349,000) | |
| Operating expenses | ||||||||||||||
| PeopleK3 | (13,067) | (12,933) | (12,991) | (13,067) | (12,893) | (13,302) | (12,648) | (13,098) | (13,110) | (12,867) | (12,884) | (13,340) | (156,200) | |
| Technology & cloudK4 | (3,759) | (3,730) | (3,763) | (3,823) | (3,786) | (3,854) | (3,853) | (3,961) | (3,950) | (3,919) | (3,993) | (3,909) | (46,300) | |
| Vendor & outsourcedK2 K5 K6 | (3,232) | (3,143) | (3,120) | (3,206) | (3,196) | (3,252) | (3,349) | (3,326) | (3,176) | (3,284) | (3,329) | (3,287) | (38,900) | |
| Facilities | (1,497) | (1,506) | (1,494) | (1,506) | (1,499) | (1,510) | (1,521) | (1,504) | (1,512) | (1,520) | (1,512) | (1,519) | (18,100) | |
| Marketing | (1,047) | (1,350) | (1,487) | (1,564) | (1,667) | (1,124) | (799) | (1,363) | (1,430) | (1,325) | (1,216) | (1,428) | (15,800) | |
| Regulatory & legalK1 K6 | (274) | (289) | (299) | (246) | (249) | (260) | (265) | (232) | (236) | (240) | (243) | (267) | (3,100) | |
| Total opex | (22,876) | (22,951) | (23,154) | (23,412) | (23,290) | (23,302) | (22,435) | (23,484) | (23,414) | (23,155) | (23,177) | (23,750) | (278,400) | |
| EBITDA, base | 6,070) | 6,298) | 5,893) | 6,296) | 6,019) | 3,599) | 4,078) | 5,674) | 7,347) | 5,797) | 6,224) | 7,305) | 70,600) | |
| Kernel exposure, P50 | ||||||||||||||
| K1 Emergency-call outage | –) | –) | –) | (405) | (231) | (58) | (86) | (346) | (435) | (260) | (405) | (174) | (2,400) | (300) – (9,800) |
| K2 Alarm during change | –) | –) | –) | (152) | (87) | (21) | (32) | (130) | (163) | (98) | (152) | (65) | (900) | (150) – (2,600) |
| K3 Customer reports | –) | –) | –) | (62) | (86) | (108) | (102) | (78) | (70) | (62) | (62) | (70) | (700) | (200) – (1,600) |
| K4 Cloud spend drift | –) | –) | –) | (84) | (100) | (125) | (142) | (167) | (183) | (208) | (233) | (258) | (1,500) | (600) – (3,200) |
| K5 Vendor SLA breach | –) | –) | –) | (67) | (67) | (67) | (67) | (67) | (67) | (66) | (66) | (66) | (600) | (100) – (1,900) |
| K6 Phishing to incident | –) | –) | –) | (91) | (90) | (89) | (89) | (89) | (88) | (88) | (88) | (88) | (800) | (150) – (4,500) |
| Kernel P50 above EBITDA | –) | –) | –) | (687) | (549) | (417) | (457) | (725) | (823) | (660) | (833) | (629) | (5,780) | |
| EBITDA, risk-adjusted | 6,070) | 6,298) | 5,893) | 5,609) | 5,470) | 3,182) | 3,621) | 4,949) | 6,524) | 5,137) | 5,391) | 6,676) | 64,820) | 58,721 – 66,798 |
| EBITDA, budget | 6,000) | 6,120) | 6,000) | 6,120) | 6,180) | 5,400) | 5,100) | 6,000) | 6,420) | 6,120) | 6,180) | 6,360) | 72,000) | |
| Variance to budget | 70) | 178) | (107) | (511) | (710) | (2,218) | (1,479) | (1,051) | 104) | (983) | (789) | 316) | (7,180) | (13,279) – (5,202) |
| Depreciation & amort. | (2,549) | (2,559) | (2,569) | (2,584) | (2,594) | (2,607) | (2,614) | (2,627) | (2,638) | (2,639) | (2,656) | (2,664) | (31,300) | |
| EBIT, risk-adjusted | 3,521) | 3,739) | 3,324) | 3,025) | 2,876) | 575) | 1,007) | 2,322) | 3,886) | 2,498) | 2,735) | 4,012) | 33,520) | 27,421 – 35,498 |
| Capital expenditure | ||||||||||||||
| Technology | (1,822) | (2,374) | (3,102) | (2,652) | (3,201) | (3,345) | (1,464) | (2,436) | (3,210) | (3,244) | (3,739) | (5,611) | (36,200) | |
| Remediation reserveK1 K6 | (400) | (400) | (400) | (400) | (400) | (400) | (400) | (400) | (400) | (400) | (400) | (400) | (4,800) | |
| Kernel P50 remediation | –) | –) | –) | (174) | (112) | (51) | (61) | (152) | (183) | (122) | (173) | (92) | (1,120) | |
| Capex, risk-adjusted | (2,222) | (2,774) | (3,502) | (3,226) | (3,713) | (3,796) | (1,925) | (2,988) | (3,793) | (3,766) | (4,312) | (6,103) | (42,120) | (41,351) – (45,016) |
In the illustration, six kernels take A$5.78m off a base EBITDA of A$70.6m, and the envelope runs from A$58.7m to A$66.8m against an A$72.0m budget that even the P90 misses. The emergency-call kernel is about a third of the P50 and 62% of the downside variance. When the CFO calls about a possible extinction-level event, the come-to-Jesus mandate can be read backwards from that one line. Otherwise every team has to anticipate every failure.
Most of what looks permanent has never been tested, so when it breaks, its fragility is revealed rather than caused.
Method and sources
Optus facts and times come from the independent review by Kerry Schott AO for the Optus board, 12 December 2025. Sandcastle plates show one seeded simulated run per arm, with aversion capped at 0.74, 0.85 and 0.96. An episode counts as handled if its persona acted within about 1.75 hours. Section 7's ledger combines the bands as independent risks (root-sum-square).
- Office Space (1999), written and directed by Mike Judge, 20th Century Fox · two stills over the simulation, set in halftone for commentary
- Isaac Asimov, The Caves of Steel (1954) · "Prejudice is a wonderful thing for saving a man the trouble of having to think for himself, because it provides him with pre-built conclusions"
- Google SRE Workbook · error budget policy, and alerting on SLOs by burn rate over two windows, with slower burns routed to tickets rather than pages
- PagerDuty open-source incident response docs, and Atlassian severity levels · a four or five row SEV table with plain criteria, named roles and cadence, under "when in doubt, go higher"
- FAIR (Open Group O-RA/O-RT), and Douglas Hubbard, How to Measure Anything · risk as loss-event frequency times loss magnitude, entered as ranges and run through Monte Carlo; calibrated ranges over high-medium-low
- ISO/TS 22317:2021 business impact analysis · impact by category at one hour, four hours, one day and one week per activity, with the maximum tolerable period of disruption inside it: a cost-of-delay curve
- Howard (1966), value of information · worth is the expected improvement in a decision's outcome, and zero where the answer cannot change the decision
- Cloudflare, Stripe and Etsy postmortem practice, and Learning from Incidents · public timelines separating started, detected and mitigated; clustering repeat incidents by class and fixing the class; near-misses as first-class records
- Too Much World (d/rksci research) · the vocabulary this piece builds on rather than restates: state and sign, reach and horizon, basins and ridges, worth and price, and the blank that must survive
- An anonymous public comment on r/accelerate, October 2026 · the "breastfeeding" framing of inherited expectations nobody did the work to build around, and the claim that a security turning-point was mostly being caught acting rather than practising. Used as a lens on GRC, not as evidence; the author is unidentified and its substantive claims are unchecked here