No, Okta, senior management, not an errant employee, caused you to get hacked

Is this much different from the economic norm of socializing losses and privatizing gains ?

Yes, they do – if done well. These are supposed to be blameless postmortems, focusing on what we can do better in the system to prevent similar issues from happening in the future. The answer is never “get better programmers”. Typical action items from the couple of recent postmortems I led/were a part of were along the lines of “decrease this alert's threshold, so we know about it earlier” ; “we need to invest in a proper local testing environment” ; “let's make our service independent of that other service” etc.

A particular bit that I appreciate about my workplaces "incident review" process is that it is anonymous and non-punitave. They exist solely to understand the root causes that lead to an incident.

They also don't stop asking why, an employee did something stupid? Why? Were they not properly trained? Why not? Were they pressured? By whom and why? Why did they pressure the first? Etc, etc.

They're can of course be a parallel disciplinary investigation of the situation so requires, but they don't share notes and you're not obligated to tell them both the same story.

It's a model I wish more organizations would adopt. People make mistakes or deliberately do things that are wrong for all kinds of reasons. Pretending they don't or won't is a poor plan.

I have written my fair share of post-mortems with a conclusion of "my knowledge of the topic/domain was limited at the time of implementation and hence created issue X due to Y".

It all depends on the organisation's culture, if management is always looking for blame you'll get meaningless incident reviews caused by fear, if there's trust you'll get a larger share of honest reviews with actionable points to minimising the risk of it happening again.

> What is the share of newly created profits and seized market opportunities due to rushing things out?

If the latter is greater then the former, in some quantifiable sense, the company might be doing alright.

The problem is not what is the cost of the incidents themselves to the business. The problem is how management deals with it. In my company, they usually spend an enormous amount of time in incident reviews, trying to find the blame (usually engineers), adding more processes, firing someone, spending 6 months and $$ backfilling the role.

The true cost of poor management is often hidden in bureaucracy.

> Now engineering is subject to a witch hunt from senior management about quality concerns. Management who authorized is currently wearing a hot dog costume demanding to know who crashed the hot dog themed car through the wall.

Management: "Roll-out fast, fast, fast so that I can look good. But if something fails in this fast roll out, we will find a way to beat it out of engineers."