Claim
The most damaging risks in any system are not the well-known catastrophes that everyone hedges against — those have been priced in and mitigated. The most damaging risks are the ones nobody is talking about, because no one has prepared for them. When they arrive, they strike with maximum surprise and maximum damage. Risk attention is finite, and the part not allocated is where the real risk lives.
Mechanism
Risk-attention markets are roughly efficient: widely-discussed risks get analysed, hedged, insured, regulated. The remaining risk capacity is therefore concentrated in the unspoken risks — the ones nobody wrote about, nobody named, nobody built defences for. When those risks materialise, the lack of preparation amplifies the damage in two ways: (a) no infrastructure exists to absorb the shock; (b) the conceptual surprise itself produces over-reaction (panic selling, panic regulation) that compounds the underlying damage. The discipline is to actively look for the un-discussed risks — what is the dog that isn't barking? — and treat that absence as a signal, not a comfort.
Conditions
Holds when:
- The system has complex interdependencies and many possible failure modes (financial markets, supply chains, large software deployments, geopolitical scenarios).
- Risk-attention is finite — operators have to choose which risks to monitor.
- The unspoken risk has not been ignored deliberately; it's genuinely unrecognised.
Fails when:
- The risk is genuinely unforeseeable (true black swan) — discussing it wouldn't help.
- The organisation has built generic antifragility (per Taleb) such that surprise-shock matters less than specific-risk preparation.
- The "unspoken risk" the operator identifies is itself widely discussed in another community; the apparent silence is a sampling artefact.
Evidence
"the biggest risk is the one nobody is talking about (because it is, by definition, the one nobody has prepared for)"
— see raw/expert-content/experts/morgan-housel.md line 18.
Signals
- Risk-review meetings include explicit "what aren't we talking about?" exercises alongside the standard risk register.
- Pre-mortems include "imagine this fails for a reason we haven't named yet — what could it be?" as a forced exploration.
- Strategy decisions include capacity for un-modeled risk (cash reserves, optionality, generic resilience) rather than only specific-risk hedges.
Counter-evidence
Looking for "what nobody is talking about" can be a paranoia generator that prevents action — there are always things nobody is talking about, and treating each as load-bearing produces decision paralysis. The discipline is matching unspoken-risk attention to the cost of being wrong: high-stakes irreversible decisions warrant the search; low-stakes reversible decisions don't.
Cross-references
- Improvement comes from removing harm, not adding good — addition introduces unknown failure modes; subtraction does not, Iatrogenics — when the intervention causes more harm than the disease — most "fixes" in complex systems are net-negative — Taleb's adjacent claims that protect against unknown risks via subtractive design.
- Lollapalooza: when 3+ biases pull the same way, the outcome breaks single-model reasoning — Munger's claim that compound-bias produces extreme outcomes; Housel's claim is the related "unmonitored risk" version.
- The less you know, the more confident you are — WYSIATI builds the cleanest stories from the thinnest data — Kahneman's WYSIATI is the cognitive substrate; the un-discussed risk is invisible because it's not in working memory.