In 1975, University of Chicago economist Sam Peltzman published a study that infuriated the safety establishment. He looked at the effect of mandatory seatbelt laws on traffic fatalities and found something no one wanted to hear: the laws didn't reduce total traffic deaths. Drivers who buckled up drove more aggressively — faster, closer to the car ahead, more willing to take risks in bad weather. The seatbelts saved the drivers. The driving behaviour killed more pedestrians and cyclists. The net effect on total fatalities was roughly zero. Safety equipment changed behaviour in a direction that consumed the safety margin it created.
This is risk compensation: when a safety measure is introduced, people adjust their behaviour to offset the protection — taking risks they would not have taken without the safety net. The mechanism is not stupidity. It is rational recalibration. If a new safety device reduces the cost of a crash from catastrophic to manageable, the expected cost of risky behaviour drops. People respond to that new expected cost by tolerating more risk. The safety device doesn't fail. It succeeds — and the behavioural response to that success erodes the net benefit.
The pattern repeats across every domain where safety measures exist. Antilock braking systems were supposed to reduce accidents. Studies by the Munich Institute for Traffic Research found that drivers with ABS brakes drove faster, followed more closely, and braked later. The technology worked flawlessly. The humans adapted to the technology by pushing harder. Skydivers equipped with automatic activation devices — which deploy the reserve parachute if the jumper hasn't deployed by a safe altitude — take riskier jumps, pull later, and attempt more aggressive manoeuvres. The AAD is a genuine lifesaver. It is also a genuine risk amplifier. Football helmets were introduced to prevent skull fractures. They succeeded. They also enabled head-first tackling techniques that produced an epidemic of chronic traumatic encephalopathy that bare-headed players would never have risked.
The business applications are the ones that matter most for builders. Abundant venture capital funding is a safety net. A founder with $50M in the bank and 36 months of runway makes different decisions than a bootstrapped founder with six months of cash. The cushion doesn't just provide time. It changes risk appetite. The well-funded founder pursues moonshot product bets, hires ahead of revenue, enters markets without unit economics — behaviours that a cash-constrained founder cannot afford. Sometimes this works brilliantly. Often it produces the startup equivalent of driving faster because you're wearing a seatbelt. Government bailout expectations produce the same dynamic at institutional scale. When banks believe they will be rescued from catastrophic losses, they take risks that create catastrophic losses. The safety net doesn't prevent the crisis. It funds the behaviour that causes the crisis.
The core insight is uncomfortable: safety nets change incentives, and changed incentives change behaviour, and changed behaviour can neutralise or reverse the safety the net was supposed to provide. Every safety measure has a first-order effect (reduced harm) and a second-order effect (increased risk-taking). The net outcome depends on which effect dominates — and it is almost never measured.
Section 2
How to See It
Risk compensation hides behind good intentions. The safety measure is visible and measurable. The behavioural response is diffuse and deniable. Nobody admits they drive faster because they have airbags. Nobody admits they take bigger bets because they have investor backing. The compensation happens below the level of conscious strategy — which makes it almost impossible to detect from the inside.
The tell is a gap between expected and actual outcomes. The safety measure should have reduced harm by X. The actual reduction was X minus the behavioural response. That gap is risk compensation — and it shows up in every domain where protection exists.
Startup Strategy
You're seeing Risk Compensation when a well-funded startup burns through cash on speculative initiatives it would never have attempted with less funding. The Series B closes at $40M. Within six months, the company launches three new product lines, hires 200 people, and enters two new markets simultaneously. Each initiative has a plausible strategic rationale. The aggregate behaviour — betting on everything at once — is risk compensation. The funding cushion reduced the perceived cost of failure on any single bet, so the company placed more bets, larger bets, and less rigorous bets than a capital-constrained competitor would tolerate. The funding didn't improve strategy. It reduced the pain of bad strategy.
Financial Systems
You're seeing Risk Compensation when institutions take larger risks because they expect to be rescued from the consequences. The 2008 financial crisis was risk compensation at civilisational scale. Banks packaged subprime mortgages into securities, leveraged 30:1, and built portfolios that could not survive a 5% decline in housing prices. The implicit government backstop — the belief that institutions deemed "too big to fail" would be bailed out — functioned as the safety net. The bailout expectation didn't cause the crisis directly. It removed the fear that would have prevented the behaviour that caused the crisis. The insurance created the fire.
Technology & Cybersecurity
You're seeing Risk Compensation when organisations with expensive security infrastructure become careless about basic security hygiene. A company deploys a $2M endpoint detection platform and a zero-trust network architecture. Six months later, employees are sharing passwords over Slack, clicking phishing links, and storing API keys in plaintext. The security infrastructure created a psychological safety net — "IT will catch anything" — that reduced individual vigilance. The tools work. The humans compensated by lowering their guard. The most common breach vector is not a sophisticated attack that defeats advanced defences. It is a basic attack that exploits the carelessness that advanced defences enabled.
Product & Engineering
You're seeing Risk Compensation when comprehensive test suites make developers less careful about the code they write. A team with 95% test coverage ships code faster and reviews less carefully — "the tests will catch it." The test suite is a genuine safety net. It is also a genuine invitation to write sloppier code with less manual review. The net effect on bug rates can be flat: better automated detection offset by worse initial code quality. The safety measure didn't fail. The behaviour adapted to consume the margin it provided.
Section 3
How to Use It
Risk compensation means that safety measures must be designed with the behavioural response built into the calculation. The question is never "does this safety measure reduce risk?" It is "does this safety measure reduce risk net of the behavioural change it induces?"
Decision filter
"Before implementing any safety measure, buffer, or backstop, ask: how will behaviour change once people know this protection exists? If the behavioural response consumes most of the safety margin, the measure is an expensive illusion. Design for the post-adaptation equilibrium, not the pre-adaptation ideal."
As a founder
Treat your runway like it's half of what it actually is. This is not conservative financial management — it is a structural defence against risk compensation. If you have 24 months of runway and you know it, your decision-making will calibrate to 24 months. You will tolerate initiatives that don't show results for 12 months. You will hire ahead of revenue. You will defer hard decisions about unit economics. If you mentally operate as though you have 12 months, you make tighter bets, demand faster feedback loops, and kill underperformers earlier. Tobi Lütke ran Shopify with this discipline even after going public — maintaining the resource constraints of a bootstrapped company inside a billion-dollar enterprise. The constraint was artificial. The behaviour it produced was real.
As an investor
When evaluating a portfolio company's risk profile, adjust for the safety net your capital provides. A founder who raised $80M will make systematically different decisions than the same founder would make with $8M. This is not a character flaw. It is risk compensation — a predictable response to changed incentives. The due diligence question is not "is this founder disciplined?" It is "what structures exist to maintain discipline after the capital creates a cushion?" Milestone-based funding, board governance, and capital allocation frameworks are not bureaucratic overhead. They are the structural equivalent of keeping the seatbelt but adding a speed governor.
As a decision-maker
Audit your organisation's safety nets for compensatory behaviour. Every insurance policy, backup system, compliance framework, and disaster recovery plan creates a subtle permission to be less careful. This does not mean you should remove safety nets. It means you should design them so the behavioural response is accounted for. The best approach is layered safety: visible safety measures that people know about (and will compensate for) plus invisible safety measures that catch the failures the compensation creates. A test suite your developers know about plus code review practices that assume the test suite will miss things. A financial reserve your team knows about plus a hidden reserve that catches the spending the known reserve encourages.
Common misapplication: Concluding that safety measures are useless and should be eliminated. This is backwards. Risk compensation does not mean safety nets fail. It means safety nets produce less net benefit than their designers expected because the behavioural response partially offsets the protection. Seatbelts still save lives — just fewer lives than a model that assumes unchanged driving behaviour would predict. The correct response is not to remove the seatbelt. It is to account for the behavioural change in your safety calculations and design complementary systems that address the compensatory risk.
Section 4
The Mechanism
Section 5
Founders & Leaders in Action
The leaders who navigate risk compensation most effectively share a structural awareness: they understand that safety, capital, and protection change behaviour — and they design systems to counteract the compensatory drift toward excess risk. What separates them from the founders who fall victim to it is not superior willpower. It is superior system design. They build constraints that survive the moment when the cushion makes constraint feel unnecessary.
The common thread: each leader below treated abundance as a threat to be managed, not a gift to be enjoyed. They created artificial scarcity, maintained artificial urgency, and designed decision architectures that forced the organisation to behave as though the safety net didn't exist — even when it did.
Hastings built Netflix with a discipline that resisted the risk compensation that scale typically enables. As Netflix grew from DVD rental to streaming dominance, the natural drift would have been toward bloat—more hires, more projects, longer timelines, and softer accountability. Hastings countered with the keeper test: "If someone left for a similar job at a peer company, would you fight to keep them?" The test forced continuous pruning. It was a structural defence against the cushion that success creates. Well-funded companies drift toward larger teams and weaker accountability because the cushion reduces the cost of each marginal hire. Hastings maintained the behavioural patterns of a resource-constrained company inside a resource-rich one. The safety net existed. The operating culture behaved as though it didn't.
Bezos institutionalised a specific form of anti-compensation discipline: the "Day 1" philosophy. Day 1 meant operating with the urgency, resourcefulness, and risk sensitivity of a startup — regardless of Amazon's actual size and resources. This was a direct counter to risk compensation at organisational scale. As Amazon grew, every natural incentive pushed toward compensatory behaviour: more cash meant more tolerance for slow initiatives, bloated teams, and speculative bets without clear customer value. Bezos treated the abundance of resources as a threat to decision quality, not an advantage. The two-pizza team rule, the single-threaded leadership model, and the insistence on written narratives over slide decks were structural constraints designed to prevent the behavioural drift that abundant resources produce. Bezos didn't trust humans — including himself — to maintain startup discipline inside a trillion-dollar safety net. He built systems that enforced it.
Musk's approach at SpaceX inverted the standard risk compensation dynamic. Instead of adding safety margins that would slow development and increase costs, Musk designed a development process that accepted controlled failures as cheaper than excessive caution. The "test, fail, iterate" approach to rocket development was a deliberate rejection of the aerospace industry's risk compensation pattern: NASA and traditional contractors added so many safety measures, reviews, and redundancies that each rocket cost billions and took a decade to develop. The safety infrastructure didn't just protect against failure — it compensated developers into a risk-averse posture where no one would approve a design without years of analysis. Musk stripped the safety theatre and replaced it with rapid iteration. SpaceX rockets blew up on the pad. Each explosion was cheaper than the safety bureaucracy that would have prevented it. The insight was that the aerospace industry's safety measures had produced risk compensation in reverse — so much protection against failure that the industry had become incapable of the productive risk-taking that innovation requires.
Section 6
Visual Explanation
Risk compensation operates as a feedback loop between safety measures and behaviour. The safety measure reduces objective risk. The reduced risk changes perceived danger. The changed perception adjusts behaviour toward more risk. The increased risk-taking consumes part or all of the safety margin the measure created.
The top section traces the causal chain: a safety measure reduces objective risk, perceived danger drops below the individual's setpoint, behaviour adjusts toward more risk-taking, and the increased risk feeds back into the system — partially or fully consuming the safety margin. The feedback loop on the right is the mechanism Peltzman identified: safety and behaviour are coupled, not independent. You cannot change one without changing the other.
The bottom section shows three possible net outcomes. On the left, the expected outcome if behaviour didn't change — the full safety benefit realised. In the centre, partial compensation — the safety measure helps, but less than expected because behaviour adapted. On the right, full compensation — the behavioural response consumes the entire safety margin, producing zero net improvement. Peltzman's traffic data suggested outcomes closer to the right. Most real-world safety interventions land in the centre — some net benefit, but substantially less than the engineering models predicted.
The critical insight the diagram reveals: the feedback loop never stops running. The behavioural adjustment isn't a one-time recalibration. It is continuous. As people acclimate to the safety measure, the compensation deepens. A driver with new ABS brakes drives slightly more aggressively in month one. By month twelve, the aggressive driving is the new baseline and the original safety margin has been fully consumed. A startup with fresh funding exercises modest caution initially. By the third quarter, the spending patterns have normalised and the discipline has evaporated. The feedback loop tightens over time — which means the net safety benefit of any intervention decays as the protected population adapts to it.
Section 7
Connected Models
Risk compensation sits at the intersection of incentive design, second-order thinking, and systems dynamics. It is the behavioural mechanism that connects safety engineering to moral hazard, and the lens through which every protective measure should be evaluated.
Reinforces
Moral Hazard
Moral hazard is risk compensation applied to insurance and bailouts. When a party is protected from the consequences of their actions, they take actions they otherwise wouldn't. Bank deposit insurance creates moral hazard: depositors don't monitor their bank's risk-taking because they know they'll be made whole. The bank, freed from depositor scrutiny, takes more risk. Risk compensation provides the behavioural mechanism — the safety net reduces perceived danger, and behaviour adjusts accordingly. Moral hazard names the economic structure. Risk compensation names the psychological process. They are the same phenomenon viewed from different disciplines.
Leads-to
Unintended Consequences
Every safety measure carries the risk of unintended consequences — and risk compensation is one of the most predictable. Regulators mandate seatbelts expecting fewer deaths. The behavioural response redistributes risk to pedestrians. The net effect can be zero or negative. Unintended consequences names the category of outcomes that interventions produce beyond their designers' intent. Risk compensation names the specific mechanism: people adapt to protection by taking more risk. Second-order thinking is the discipline that surfaces these effects before they manifest. The design principle: model the behavioural response as part of the intervention, not as an afterthought.
Reinforces
Margin of Safety
Benjamin Graham's margin of safety — buying assets at a significant discount to intrinsic value — is a deliberate buffer against error. Risk compensation threatens this buffer: once investors know they have a margin of safety, they become less rigorous in their valuation, effectively spending the margin through reduced analytical discipline. The most disciplined value investors treat their margin of safety as invisible — they calculate it but behave as though it doesn't exist. This is a structural defence against the compensatory behaviour that would otherwise erode the margin.
Section 8
One Key Quote
"The net effect of safety regulation is not the saving of lives but a redistribution of risk — from those protected by the regulation to those who are not."
— Sam Peltzman, 'The Effects of Automobile Safety Regulation,' Journal of Political Economy (1975)
Peltzman's observation contains a dimension most people miss: risk compensation doesn't just neutralise safety benefits. It redistributes them. The seatbelted driver is safer. The pedestrian is less safe. The well-funded startup takes bigger swings. The employees whose jobs depend on those swings bear the downside. The bailed-out bank survives. The taxpayers who funded the bailout absorb the cost. Every safety measure creates a redistribution — from the protected party (who compensates with riskier behaviour) to the unprotected parties (who absorb the consequences of that behaviour without any offsetting safety net).
This redistribution is the most ethically important dimension of risk compensation and the one most consistently ignored. Safety regulators measure the effect on the protected population. They rarely measure the effect on everyone else. A complete analysis of any safety measure must ask not just "does it reduce risk for the target group?" but "where does the displaced risk land?" The answer is almost always: on someone with less power, less visibility, and less protection.
The startup parallel is precise. When a well-capitalised company makes a reckless product bet, the founders and investors are protected by diversification and deal structures. The employees who joined for equity, the customers who built workflows on the product, the smaller competitors who were priced out of the market by subsidised pricing — they absorb the displaced risk without the safety net that enabled it. The redistribution is invisible to the risk-takers because they never meet the risk-bearers.
Peltzman's insight isn't just about traffic. It is about the structural blindness that every safety net creates toward the people standing outside it. The question that should follow every safety intervention — "who absorbs the risk I'm now free to take?" — is almost never asked. Not because the answer is hard to find, but because the people asking are the ones inside the net.
Section 9
Analyst's Take
Faster Than Normal — Editorial View
Risk compensation is one of the most consistently ignored dynamics in startup strategy, corporate governance, and regulatory design.
The pattern I see in every well-funded startup: the Series B changes behaviour before it changes strategy. The cash hits the account and within three months, hiring accelerates, project scope expands, timelines stretch, and the hard conversations about unit economics get deferred. Nobody decides to become less disciplined. The cushion changes the calculus on every marginal decision — and a thousand slightly-less-disciplined marginal decisions compound into a fundamentally different operating posture. The startups that outperform after raising large rounds are the ones that build structural constraints against this drift: milestone-based capital allocation, forced prioritisation frameworks, and leaders who treat the runway as a finite resource regardless of its actual size.
In corporate governance, risk compensation explains why compliance programmes often fail to reduce misconduct. A comprehensive compliance framework creates the organisational equivalent of an airbag. Employees perceive the compliance infrastructure as a safety net — "if there were real risks, compliance would flag them" — and become less vigilant about their own ethical judgment. The compliance programme doesn't fail to detect misconduct. It succeeds as a detection tool while simultaneously failing as a deterrent, because its visible presence reduces the perceived need for individual ethical vigilance. The best compliance programmes account for this by combining institutional safeguards with personal accountability structures that maintain individual skin in the game.
The venture capital industry is a risk compensation machine. Easy money reduces the cost of failure. Reduced cost of failure increases risk-taking. Increased risk-taking produces more failures. More failures produce demands for more capital to try again. The cycle is self-reinforcing. The founders who navigate this best are the ones who maintain the discipline of scarcity inside conditions of abundance — treating every dollar as though it were the last dollar, even when the bank account says otherwise. This is psychologically difficult. It is also the single strongest predictor of capital-efficient growth I've observed.
The regulatory implication is that safety measures should be evaluated on their net effect, not their direct effect. A regulation that reduces the target risk by 50% but increases compensatory risk-taking by 40% delivers a 10% net improvement — not the 50% that advocates projected. Most regulatory impact assessments ignore the behavioural response entirely, which means most safety regulations deliver less benefit than their supporters claim and more than their critics claim. The honest assessment lives in the uncomfortable middle: safety measures help, but less than you think, because behaviour adapts.
Section 10
Test Yourself
Risk compensation hides inside rational-sounding explanations for changed behaviour. The challenge is distinguishing between genuine strategic adaptation and unconscious risk expansion driven by the presence of a safety net.
Is Risk Compensation at work here?
Scenario 1
A SaaS company implements comprehensive automated testing with 97% code coverage. Over the next six months, the team ships features 40% faster. Code review thoroughness decreases — reviewers spend less time per pull request, skip edge-case analysis, and approve changes with fewer comments. Bug reports from customers increase by 15% despite the test suite catching 30% more bugs in CI.
Scenario 2
A hedge fund implements a sophisticated Value-at-Risk (VaR) model that estimates maximum daily losses with 99% confidence. The risk management team uses the model to set position limits. Over two years, the fund gradually increases its leverage from 3:1 to 8:1, with each increase justified by the VaR model showing acceptable risk levels. The risk management team signs off on every increase.
Scenario 3
A manufacturing company installs new safety guards on its industrial equipment after three workplace injuries. In the six months following installation, injury rates drop by 60%. Workers report feeling safer. Equipment utilisation increases because workers are willing to operate machines they previously avoided. No change in safety violations or near-miss reports is observed.
Section 11
Top Resources
The risk compensation literature spans economics, psychology, public health, and organisational behaviour. The research base is contentious — Peltzman's original findings remain debated — but the core insight has been replicated across enough domains to constitute a robust finding with clear practical implications.
Start with Peltzman for the economic foundation, extend to Wilde for the psychological theory, and apply through Adams and Taleb for the design and organisational implications.
The paper that launched the field. Peltzman's analysis of federal safety mandates and their net effect on traffic fatalities remains the foundational reference. The data has been debated for decades, but the core insight — that safety measures induce behavioural adaptation that partially offsets their benefits — has been confirmed across domains far beyond automotive regulation. Essential reading for anyone designing safety systems, incentive structures, or regulatory frameworks.
Wilde's risk homeostasis theory formalises the psychological mechanism behind Peltzman's economic finding. The core claim — that individuals maintain a target level of risk and adjust behaviour to restore that target when external conditions change — provides the theoretical foundation for understanding why safety measures consistently underperform expectations. The book includes case studies from transportation, public health, and occupational safety.
Adams extends risk compensation into a general theory of risk management with a cultural dimension. His "risk thermostat" model — a simplified version of Wilde's homeostasis theory — is the most accessible framework for understanding why people adjust behaviour in response to safety measures. The book is particularly strong on the policy implications: why mandatory helmet laws, safety regulations, and environmental protections consistently deliver less benefit than their advocates predict.
Taleb's treatment of overprotection and iatrogenics — harm caused by the healer — provides the systems-level framework for understanding risk compensation. His argument that removing volatility from systems makes them fragile is the antifragility version of risk compensation: safety measures that suppress small failures create the conditions for large ones. The chapters on skin in the game and the agency problem connect risk compensation to incentive design and organisational structure.
Finkelstein's empirical work on the RAND Health Insurance Experiment provides the most rigorous quantification of risk compensation in a specific domain. Participants with more generous health insurance consumed 30-40% more healthcare services than those with higher cost-sharing — a clean measurement of the behavioural response to a safety net. The methodology is a template for measuring risk compensation in any domain where the safety measure and the behavioural response can be isolated.
Risk Compensation — How safety measures change behaviour, with the behavioural response consuming the safety margin the measure was designed to provide.
Tension
Loss Aversion
Loss aversion — the tendency to feel losses roughly twice as intensely as equivalent gains — creates a paradox with risk compensation. People are loss-averse, yet they take more risk when protected. The resolution: loss aversion operates on perceived risk, not objective risk. A safety measure reduces perceived risk. The loss-averse person, now feeling safer, recalibrates toward the risk level that matches their target. The safety net doesn't eliminate loss aversion. It shifts the reference point. The person compensates until they're back at the level of perceived risk that triggers their loss-averse caution. Understanding both models reveals why safety interventions often underperform: loss aversion would predict extreme caution, but risk compensation shows that perceived safety erodes that caution.
Enables
Incentive-Caused Bias
Charlie Munger's insight that incentives drive behaviour more than anything else explains why risk compensation is so predictable. Safety measures change incentives — they reduce the cost of failure, which increases the expected value of risk-taking. The behavioural response is not irrational. It is a rational response to changed incentives. Incentive-caused bias names the general principle. Risk compensation is the specific case where the incentive change comes from protection rather than reward. The prescription is the same: design incentives for the behaviour you want after the safety measure, not before it.
Leads-to
Second-Order Thinking
Risk compensation is a second-order effect. The first-order effect of a safety measure is reduced risk. The second-order effect is changed behaviour. Most safety analysis stops at the first order — "the seatbelt reduces crash injuries" — and ignores the second — "the seatbelt also changes driving behaviour." Second-order thinking is the discipline of asking "and then what?" after every intervention. In the context of risk compensation, the answer is always: "and then people will adjust their behaviour to spend some or all of the safety margin." Ignoring this adjustment is not optimism. It is a modelling error.
The design principle for builders: create safety nets that are invisible to the people they protect. Visible safety nets invite compensation. Invisible safety nets catch failures without changing the behaviour that produces them. A monitoring system that alerts the team after an outage is visible — it reduces urgency about prevention. A monitoring system that prevents outages silently, without the team knowing it intervened, preserves the team's sense of vulnerability and the behaviour that vulnerability produces. The ideal safety architecture is invisible to operators and visible only to designers.
The uncomfortable truth about risk compensation is that it is rational. People are not being stupid when they drive faster with airbags or spend more aggressively with venture funding. They are responding correctly to a changed cost structure. The safety measure reduced the expected cost of failure, and they adjusted their behaviour to reflect the new expected cost. The problem is not irrationality. The problem is that the individual rationality produces a collective outcome that nobody intended. Each driver is individually rational. The aggregate traffic death rate doesn't improve. Each founder is individually rational. The aggregate startup failure rate doesn't decline despite record funding levels. Risk compensation is the tragedy of the commons applied to safety margins.
