Service Fragility and the Limits of Confidence in Operational Resilience

A conceptual perspective on dependency exposure

This paper examines the concept of service fragility and why it often remains hidden within otherwise mature operational resilience programmes.

Note on intent

This paper is a conceptual examination of service fragility in operational resilience. It does not propose a framework, methodology, maturity model, or implementation approach.

Its purpose is to support clearer judgement about the condition and interaction of dependencies that sustain service recovery, and to highlight where confidence in resilience may outpace real-world capability.

The paper is intended to inform discussion and reflection, not to prescribe solutions or controls.

Introduction

Operational resilience has matured significantly over recent years. Many organisations can now identify their important business services, define impact tolerances, and document the people, processes, technology, data, and third parties that underpin service delivery. From a regulatory and assurance perspective, this represents real and necessary progress.

Yet maturity of structure does not always equate to maturity of understanding.

Despite increasingly sophisticated frameworks, disruptive incidents continue to reveal weaknesses that were not fully anticipated. Services that appeared well controlled still fail in unexpected ways. Recovery actions prove slower or more complex than planned. Dependencies that were individually understood behave differently when placed under simultaneous stress.

These outcomes suggest that the challenge is not simply one of impact management, but of how resilience is being observed.

Much of operational resilience is assessed through what can be documented, mapped, and tested in isolation. This creates confidence in preparedness. It does not always illuminate how close a service may already be to disruption, nor how multiple marginal conditions may combine to reduce its ability to absorb stress.

This paper explores that gap through the concept of service fragility.

Rather than focusing on the consequences of failure, fragility is concerned with the condition of a service before failure occurs. It reflects how vulnerable a service may be given the state, interaction, and concentration of its underlying dependencies. A service can meet impact tolerances, pass assurance activities, and still be fragile in practice if the conditions that sustain recovery are weak, tightly coupled, or overly reliant on informal stability.

This paper is intentionally conceptual. It does not propose a framework, methodology, or implementation model. Its purpose is to support clearer judgement and discussion about where resilience confidence may be outpacing real-world capability, and why services that appear resilient can still surprise us under pressure.

From Impact to Fragility

Much of modern operational resilience is oriented around impact. Business Impact Assessments, impact tolerances, and scenario testing are designed to understand the consequences of disruption and the point at which harm becomes unacceptable. This perspective is essential and well established.

However, impact-focused approaches do not always explain how close a service may already be to disruption.

That question is better addressed through the lens of fragility.

Viewed through this lens, fragility reflects how vulnerable a service may be, given the condition, interaction, and concentration of its underlying dependencies.

A service may have clearly defined impact tolerances and documented recovery plans, yet still be fragile in practice if key dependencies are weak, untested, overstretched, or tightly coupled.

Why Fragility Is Hard to See

Underlying vulnerability is rarely visible during normal operations.

Services are designed to function within expected conditions. Day-to-day performance can mask underlying weaknesses, particularly when those weaknesses are marginal rather than catastrophic. Documentation may be complete. Controls may exist. Past incidents may have been resolved successfully. These signals create a sense of stability. They do not necessarily reflect how a service will behave under real stress.

One reason fragility remains hidden is that it does not usually arise from obvious failures. Instead, it accumulates through gradual drift, rational local decisions, and interactions between dependencies that appear acceptable when viewed in isolation. Safety science and systems research has long shown that serious failures rarely emerge from single causes. They arise from the way systems adapt, optimise, and compensate over time.

Dependencies that perform reliably on their own may behave very differently when placed under simultaneous strain. Recovery actions that appear robust in isolation may compete for the same people, systems, or external support. Informal workarounds that improve efficiency in normal conditions may quietly reduce margin when conditions deteriorate.

Success itself can also conceal fragility. When services continue to operate, even with underlying weaknesses, confidence is reinforced. Stability is interpreted as evidence of resilience, rather than as a temporary balance maintained through effort, experience, or favourable conditions.

As a result, fragility often becomes visible only in hindsight, once disruption has already forced multiple dependencies to interact under pressure. At that point, what failed is not usually a single control, but the assumption that those controls would continue to hold together.

In this sense, fragility is often located not where problems are most visible, but where problems have not yet appeared. The absence of failure is mistaken for evidence of strength, when it may simply reflect that certain conditions have not yet been tested together.

This makes fragility difficult to detect using traditional assurance approaches. Checklists, plans, and individual test outcomes provide valuable signals, but they do not easily reveal how close a service may be to its limits, nor how quickly stability may erode once those limits are crossed.

The Role of Dependencies

Modern services depend on a complex network of interacting components. These commonly include people, processes, technology, data, cyber controls, third parties, physical locations, testing capability, change activity, and governance.

Each is typically managed, assured, and improved through separate structures and disciplines.

Viewed individually, many of these dependencies may appear stable, controlled, or acceptable. However, resilience is not determined by their individual condition, but by how they behave together.

Fragility emerges when dependencies that are marginal on their own become tightly coupled in practice. Recovery actions may rely on the same individuals. Multiple systems may require the same access routes, credentials, or environments. Third parties may support several critical components simultaneously. These interactions are rarely visible in static documentation, yet they become decisive during disruption.

Importantly, fragility does not require a single critical weakness. It is often created by the alignment of several conditions that are each considered tolerable. A service may depend on experienced individuals who are usually available, technologies that are generally reliable, suppliers that have historically performed well, and processes that function adequately under normal conditions. Together, these can create a service that appears robust, while quietly operating with limited margin.

Dependencies also evolve. Staff change roles. Technologies age. Suppliers alter operating models. Recovery processes are adjusted to accommodate business priorities. Over time, these small shifts can alter how dependencies interact, even when individual artefacts remain up to date. Fragility, therefore, is not a fixed state, but a dynamic property of how a service is currently sustained.

Because dependencies are typically assessed within their own domains, the cumulative effect of these interactions is often underestimated. Assurance focuses on whether each dependency meets its local expectations, rather than on whether their combined behaviour can support recovery under simultaneous stress.

Understanding fragility requires bringing these interactions into view. Not to replace existing dependency management practices, but to recognise that resilience is ultimately a system outcome, not a collection of component assurances.

Confidence and Capability

Organisational confidence in resilience is largely shaped by assurance. Completed assessments, approved plans, mapped dependencies, and successful exercises all contribute to a view that services are understood and controlled. Over time, these artefacts form a narrative of preparedness.

Capability, however, is not created by assurance. It is revealed by conditions.

The extent to which confidence reflects real capability typically becomes clear only when services operate under stress, uncertainty, or constraint. It is in these moments that teams discover whether documented recovery paths remain viable, whether dependencies can be mobilised together, and whether decisions can still be made effectively when information is incomplete.

Misalignment between confidence and capability rarely arises from poor intent or inadequate effort. In most cases, it emerges because organisations are doing what is expected of them. They are meeting regulatory requirements, maintaining artefacts, and demonstrating control. The issue is not the presence of assurance, but what assurance is optimised to observe.

Formal assurance activities tend to emphasise completeness, consistency, and traceability. They confirm that dependencies have owners, plans exist, and tests have been performed. What they do not easily reveal is how those dependencies will behave together when priorities conflict, resources are constrained, or multiple failures occur simultaneously.

Testing can reinforce this effect. Exercises often validate that planned actions can be followed, rather than exploring how teams adapt when plans no longer fit the situation. Success is recorded when recovery paths are executed as designed, even if that success depends on favourable conditions, informal coordination, or individual experience.

Over time, this creates a subtle shift. Confidence hardens around what has been demonstrated before, rather than around what may be required next. Capability becomes inferred from past performance, rather than from present conditions.

This is not a failure of governance. It is a consequence of how complex systems are observed.

Fragility becomes important at this point because it draws attention back to conditions rather than artefacts. It challenges confidence not by disputing effort, but by questioning margin.

Understanding the relationship between confidence and capability is therefore not about reducing assurance, but about recognising its limits. Confidence is necessary. But when it is not continually tested against changing dependency conditions, it can quietly drift away from the capability it is meant to represent.

Why This Matters

As operational resilience continues to mature, the risk facing organisations is no longer simply one of insufficient control. It is the risk that confidence in resilience stabilises faster than the conditions that sustain it. This paper does not argue for new controls or resilience frameworks. It focuses on visibility – on understanding how close services may already be to their limits, even when existing practices appear to be working.

When fragility remains hidden, organisations may underestimate how quickly a service could degrade, how tightly recovery actions are coupled, or how dependent outcomes are on a small number of people, systems, or assumptions. Stability in normal conditions can be mistaken for resilience, even when that stability is maintained through effort, experience, or favourable alignment rather than structural margin.

This matters because disruption rarely arrives in isolation.

Incidents increasingly involve simultaneous pressures: technology failure alongside staff unavailability, supplier disruption alongside heightened customer demand, or cyber events alongside operational recovery. In these conditions, services do not fail because controls are absent, but because interactions overwhelm the margins that were never fully visible.

When confidence is built primarily on artefacts, past performance, and isolated assurance outcomes, organisations may not recognise how close some services already are to their limits. Recovery becomes slower not because plans were missing, but because dependencies could not be mobilised together as expected.

Understanding fragility does not mean predicting every failure. It means recognising that resilience is not a static state, but a relationship between system conditions and the stresses placed upon them. That relationship changes continuously, even when formal documentation does not.

If resilience confidence is not regularly recalibrated against the evolving condition and interaction of dependencies, it can quietly drift away from real-world capability. When this happens, surprise is not a failure of preparation – it is a failure of visibility.

This is why fragility matters. Not as a replacement for existing resilience practices, but as a lens that helps organisations see where confidence may be resting on conditions that no longer hold.

A Different Way of Seeing

Examining fragility does not require new frameworks, controls, or governance structures. It requires a shift in how resilience is observed.

Rather than asking only whether services meet defined impact tolerances, it invites reflection on how those services are being sustained, and how much margin exists when conditions change. It encourages attention to the interaction of dependencies, rather than their isolated status. It shifts the focus from whether plans exist, to whether recovery remains plausible when assumptions no longer hold.

This shift in perspective is uncomfortable because it challenges reassurance. It does not replace confidence with certainty. It replaces certainty with awareness.

Instead of seeking proof that services are resilient, it asks where resilience may be thin. Instead of confirming that dependencies are controlled, it asks how they might fail together. Instead of reinforcing what is already believed, it invites examination of what is quietly assumed.

Importantly, this perspective is not about pessimism. It is about honesty. It recognises that complex services are never fully knowable, and that resilience is not a property that can be declared, but a condition that must be continually observed.

By making fragility more visible, organisations do not weaken their resilience narrative. They strengthen it. They replace confidence built on static artefacts with confidence grounded in ongoing attention to system behaviour.

A different way of seeing does not promise fewer surprises. But it does promise fewer surprises that could not have been imagined.

Conclusion

Operational resilience frameworks have significantly improved organisations’ ability to understand and manage the impact of disruption. They have strengthened visibility, accountability, and preparedness across many dimensions of service delivery. That progress matters.

But impact alone does not explain why resilient services continue to surprise us.

This paper has argued that those surprises often arise not from the absence of controls, but from fragility that remains unseen. By focusing attention on the condition and interaction of dependencies before disruption occurs, fragility offers a complementary way of understanding how close a service may already be to its limits.

Fragility is not a failure state. It is a characteristic of complex systems operating under constraint. It emerges gradually, through interaction, adaptation, and drift. When it is not actively observed, confidence can harden around artefacts and past performance, even as the conditions that sustain recovery change.

Recognising fragility does not diminish the value of existing resilience practices. It sharpens them. It shifts emphasis from proving preparedness to understanding exposure, and from reassurance to awareness.

Resilience, ultimately, is not defined by what organisations believe about their services, but by how those services behave when expectations are no longer met. Making fragility visible is not about predicting failure. It is about seeing the limits of confidence before those limits are reached.

Many practitioners recognise this only after an incident, when nothing obvious was missing, yet recovery proved slower or more fragile than expected.

© 2026 Steven Hine

All rights reserved.