Give people a felt safety margin and many of them spend it. Risk compensation shows up in ABS brakes, MFA, and backup tools alike. The fix is to build so protection is invisible and cannot be traded away.
When a Munich taxi fleet was split between cars with anti-lock brakes and cars without, the ABS cabs did not crash any less often over three years, and if anything crashed slightly more, because the drivers who felt safer simply drove harder. That pattern has a name: risk compensation, the tendency to spend a new margin of safety on riskier behavior rather than bank it. I study behavioral psychology, and this one shows up everywhere in technology, not only on the road.
In the 1980s a fleet of Munich taxis was divided into cars equipped with anti-lock brakes and otherwise identical cars without them. The reasonable expectation was fewer accidents in the ABS group. Over roughly three years of records, that is not what happened. The crash rate was, per the summary, "a little higher for the cabs with ABS".
Observers riding along noted why. Drivers with ABS accelerated faster, followed more closely, and braked later, because they trusted the technology to save them. The safety device worked exactly as designed. The humans quietly adjusted their behavior until the felt level of danger returned to where it had been before.
The finding is unsettling precisely because nothing malfunctioned. Better brakes did not produce safer driving. They produced faster driving with the same amount of risk, which is a very different outcome from the one on the purchase order.
The mechanism people reach for here is a kind of behavioral thermostat. Each of us seems to carry a target level of risk we are willing to tolerate, and we act to keep our felt exposure near that set point. Raise the perceived safety of the environment and the thermostat has room to let behavior run warmer.
This is why a safety feature you can feel is a safety feature people will spend. The seat belt, the helmet, the guardrail, the backup: each changes the felt cost of a mistake, and the felt cost is the input the thermostat reads. The device does not have to fail for its benefit to erode. It only has to be noticed.
It is a close cousin of the biases I have written about in the bias you don't see is the one making your technology decisions. We rarely feel ourselves recalibrating. The adjustment happens below the level of conscious choice, which is what makes it so consistent across drivers, patients, and users of software.
The economist who put this on the map was Sam Peltzman, whose 1975 work on automobile safety regulation argued that mandated safety features were substantially offset by riskier driving. In his strongest framing, the offsets were "virtually complete, so that regulation has not decreased highway deaths". The idea that a safety mandate could fully cancel itself out is now called the Peltzman effect.
Here is where honesty about the evidence matters, because the strong version has not held up. Later empirical work found the effect is real but far smaller than Peltzman claimed. Across many contexts it "generally offsets less than half of the direct effect", and motor vehicle fatalities per capita in the United States have still fallen by more than half since the 1960s.
So the accurate reading is not "safety features are pointless." It is "safety features deliver most of their intended benefit, and a predictable slice gets eaten by behavior." You plan for the slice. You do not cancel the feature.
The effect is not confined to cars, either. A peer-reviewed analysis describes the Peltzman effect and compensatory markers in medicine, noting that "unintended behavioral responses by patients and physicians to health care interventions may explain why certain health care interventions that seem logical and foolproof fail to demonstrate real-world benefits." A rapid response team can make ward staff a little less vigilant. A screening test can make a patient a little less careful. Same thermostat, different room.
The effect is not uniform, and treating it as an iron law is its own error. Work summarizing the research points to something close to Gerald Hedlund's four moderating factors: how visible the safety measure is, how much added protection people believe it gives, how motivated they are to take risk in the first place, and how much control they feel over the outcome. A quieter, plainer treatment of the same trade appears in when safety proves dangerous, which distills it to a single line: "When we feel safe, we take more risks. When we feel unsafe, we are more cautious."
Read those factors together and the design lesson writes itself. Compensation is strongest when the protection is visible, feels large, sits in front of people who wanted to push anyway, and covers a domain where they feel in control. It is weakest when the protection is invisible, when nobody is watching for a margin to spend, and when there is nothing obvious to trade.
That is not an argument against safety. It is a specification for how to deliver it.
Once you have the pattern, you see it far from any highway. A team buys a shiny new backup tool, and within a quarter people are noticeably more casual about the changes they push, because "we can always roll back." The backup is genuinely good. The felt cost of a mistake dropped, so the mistakes crept up.
Multi-factor authentication is a familiar one. Adding a second factor is a real gain, and it can also make people feel so protected that they get lax about the first factor, reusing a weak password across accounts because the code on their phone feels like enough. The measure that was supposed to raise the floor quietly lowered the care around it.
A generous safety net at work does the same thing to craft. A staging environment that catches everything, a QA gate that "will find it," a manager who always reviews before anything ships: each can invite slightly sloppier work upstream, because someone downstream is holding the margin. This is the uncomfortable flip side of the case for friction, where a little resistance in the right place is what keeps behavior honest.
None of this means remove the backup, drop the second factor, or tear out the review. It means expect the compensation, and design so the margin is not sitting out in the open, blinking, waiting to be spent.
The constructive move is to stop bolting a control onto the outside of a system and trusting people to keep behaving carefully around it. That posture practically requests risk compensation. The alternative is to build the protection into the structure, where there is no visible safety dial to turn and nothing obvious to trade away. That is what we mean by secure by construction, and my co-founder Brian writes about the engineering side of it at briansgagne.com.
A system that does not leak by default gives its users nothing to negotiate against. If unsafe states are unrepresentable, if the default path is the secure path, if deletion and least privilege are wired in rather than remembered, then there is no felt margin for the thermostat to read. This is the same argument I made in security architecture first, everything else second and in build compliance in, stop bolting it on: the protection you cannot feel is the protection you cannot spend.
It also explains why prevention costs so much less than recovery. A visible add-on control invites the very behavior that erodes it, then someone pays for the cleanup. Structural protection does not offer that trade, so the compensation never gets a foothold. Good engineering is quiet on purpose.
The last piece follows directly. If behavior silently drifts toward a felt set point, then how safe people feel is a terrible instrument. You want to measure what a system actually faces, before anyone opts out and before anyone's confidence talks them into a shortcut.
Every small site is under steady automated probing whether its owners feel it or not, which I covered in the attack baseline every small website already faces. That real, external pressure is the honest number. It is why Kief Studio built Aegis to continuously measure exposure at the edge, counting what hits a system rather than trusting how protected its owners believe they are.
The habit of building this way generalizes past security, and you can see more of how we approach it on the Kief Studio blog. A safety feature you can feel is a feature people will spend. A system that is secure by construction, and measured against what it truly faces, gives them nothing to trade away. That is the calm version of this whole idea: do not ask people to stay careful around a margin. Build so there is no loose margin to be careless with.
Risk compensation is the tendency to adjust behavior in response to a change in perceived safety. When something makes people feel more protected, many of them take on more risk, spending the new margin rather than keeping it. The classic illustration is the Munich taxi study, where cars with anti-lock brakes did not crash less because drivers drove more aggressively.
No. The strong claim that safety gains are fully canceled out has not held up in the research. Later work found the effect real but modest, generally offsetting less than half of a safety measure's direct benefit, while road fatalities per capita have still fallen sharply over the decades. Safety features deliver most of their intended value; a predictable slice is eaten by behavior, and good design plans for that slice.
It shows up wherever a visible safeguard changes the felt cost of a mistake. A new backup tool can make people careless about what they push. Multi-factor authentication can tempt people to reuse a weak password because the second factor feels like enough. A strong QA gate can invite sloppier upstream work. The safeguard is real; the surrounding care erodes because there is a felt margin to spend.
Make the protection structural rather than felt. If unsafe states are unrepresentable and the default path is the safe path, there is no visible safety dial for anyone to trade against. Build the guardrail into the system rather than bolting it on, so the protection cannot be noticed and therefore cannot be spent. This is what secure by construction means in practice.
You measure what the system actually faces instead of how safe people feel. Perceived safety is an unreliable instrument because behavior quietly drifts toward a felt set point. Continuous, edge-level measurement of real exposure counts the pressure a system is under before anyone opts out, giving you an honest number that confidence cannot distort.
In a randomized colonoscopy trial, a longer, gentler-ending procedure was remembered as less unpleasant. That is the peak-end rule: memory is built from the peak and the end, not the average. Here is how to design both on purpose.
The safest record is the one you never collected. Data minimization treats retention as liability, not free storage, and builds deletion in as a default.
The whole industry optimizes to remove friction. But the case for friction is that a deliberate pause, a verification step, a rate limit, a cooling-off window, filters bots and bad actors, cuts regret and fraud, and protects the user.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
