Skip to main content
The Incentives Lab
Mental Models · Systems

Swiss Cheese Model

Accidents occur when multiple layers of defenses fail simultaneously.

"Every layer has holes. Catastrophe finds the alignment."

Quick answer

What is Swiss Cheese Model? Accidents occur when multiple layers of defenses fail simultaneously. Risk management is about layers, not single controls.

In the wild

A plane crash requires several safeguards to fail at once.

Why it matters in the room

Risk management is about layers, not single controls.

Counter-move

Add independent layers and monitor near-misses.

Visual · Pattern
Swiss Cheese Model — a recurring shape in how people decide.
Live example · Apply Swiss Cheese Model

Use the model. Pick the move.

Accidents occur when multiple layers of defenses fail simultaneously. You've just seen this: A plane crash requires several safeguards to fail at once. Which lever does the model recommend?

● Live

Pick a lever. There are no neutral ones — every incentive funds a behavior somewhere.

How does this land?

Pick a reaction to Swiss Cheese Model

One tap. We'll point you at the most useful next surface based on how this hits.

Human Behavior Element™ · HBE Spec

The full taxonomy entry

Every concept in the Atlas uses the same structure — so Swiss Cheese Model can be compared, recombined, and cited like an element on a periodic table.

About the standard →
M
SC
HBT-M2123
Official name
Swiss Cheese Model
Mental Models · Systems
Identity
HBT ID
HBT-M2123
Symbol
SC
Official name
Swiss Cheese Model
Synonyms
Systems
Keywords
Mental Models, Systems, human behavior, incentive design
Version
v1.0
Last updated
Maintained by The Incentives Lab
Classification
Kingdom
Cognition
Domain
Frameworks
Family
Mental Model
Class
Systems
Element
Swiss Cheese Model
Definition
Scientific
Accidents occur when multiple layers of defenses fail simultaneously.
Plain-English
Accidents occur when multiple layers of defenses fail simultaneously.
Feynman
Every layer has holes. Catastrophe finds the alignment.
Core principle
Accidents occur when multiple layers of defenses fail simultaneously.
One-sentence summary
Risk management is about layers, not single controls.
Mechanisms
Psychological
Accidents occur when multiple layers of defenses fail simultaneously.
Behavioral econ.
Risk management is about layers, not single controls.
Neurological
Reward, threat, and salience circuits bias attention toward the cue.
Evolutionary
Heuristics that paid off in ancestral environments now misfire in modern systems.
Sociological
Group norms and status incentives reinforce the pattern across a team.
Computational
Models trained on biased human signals will replicate and amplify the pattern.
Systems thinking
Feedback loops between metrics, incentives, and behavior lock the pattern in place.
Signals & signature
Inputs (activators)
A plane crash requires several safeguards to fail at once.
Outputs (observable)
Risk management is about layers, not single controls.
Behavioral signature
You see Swiss Cheese Model when the explanation for a decision sounds reasonable but the outcome keeps repeating.
Behavioral molecules
Often combines with related Atlas entries — see the rail below.
Pathways · before
A goal, metric, or contract clause makes the behavior rational locally.
Pathways · after
Locally rational choices accumulate into a systemic distortion.
Domains where it shows up
  • Business
  • Leadership
  • Government
  • Healthcare
  • Education
  • Sales
  • Marketing
  • AI
  • Negotiation
  • Media
  • Public Policy
  • Relationships
Examples
Everyday
A plane crash requires several safeguards to fail at once.
Modern
Risk management is about layers, not single controls.
Historical
A pattern repeatedly documented since the foundational behavioral science literature on mental model.
Famous experiments
See the References block — primary papers in the Atlas link out to the original studies.
Design principles
How to leverage
Risk management is about layers, not single controls.
How to reduce
Add independent layers and monitor near-misses.
How to redesign
Add independent layers and monitor near-misses.
The Perverse Incentive Lens™
How it's exploited
Organizations weaponize swiss cheese model — sometimes deliberately, often by accident — when metrics reward the symptom rather than the outcome.
Common perverse incentives
Volume metrics, short review windows, bonus cliffs, and contracts that pay on activity rather than impact.
Failure modes
When Swiss Cheese Model dominates, teams optimize for the dashboard while the real outcome quietly degrades.
Incentive redesign
Add independent layers and monitor near-misses.
Ethical considerations
Don't engineer swiss cheese model into customers, employees, or citizens as a manipulation tactic — design for informed choice instead.
Diagnostic questions
  • Where in our org would Swiss Cheese Model most often show up unnoticed?
  • Which metric, ritual, or contract clause quietly rewards Swiss Cheese Model?
  • If we removed every payoff for Swiss Cheese Model, what behavior would replace it?
  • Who benefits when Swiss Cheese Model persists — and who pays the cost?
Organizational warning signs
Metrics
A KPI is hit while the underlying outcome stalls or worsens.
Behaviors
People route around the rule rather than challenge it.
Language
'That's just how we do it here.' / 'The system requires it.'
Culture
Naming the pattern is treated as disloyalty.
Red flags
  • People defend the status quo using the language of swiss cheese model.
  • Decisions cluster around the easiest narrative rather than the strongest evidence.
  • New data changes the slide deck but not the decision.
  • Anyone naming the pattern is treated as the problem.
Intervention playbook
Immediate
Make the perverse payoff visible to the people creating it.
30-day
Run a small pilot that pays for the outcome, not the proxy.
Long-term
Rewrite the comp plan, contract, or ritual so the right behavior becomes the easy behavior.
AI considerations
Detect
Audit training data and reward signals for the same pattern this element describes.
Avoid amplifying
Don't optimize models on metrics that already encode the perverse incentive.
Counteract
Use the model to surface where the pattern is most active, then redesign the incentive — not the model.
Measurement
Metrics
Outcome-to-proxy ratio over time.
Assessment
The Incentives Lab III Diagnostic.
Survey
Calibrated pulse questions on rules vs. outcomes.
Behavioral signals
Where people work around the system.
Observational
Where the dashboard and the lived experience disagree.
Scientific evidence
Evidence grade
Synthesized from the behavioral science literature; see Atlas references.
Replication
Tracked in the Atlas as primary, replicated, or contested.
Intervention confidence
Moderate — patterns generalize, mechanisms vary by context.
Research consensus
Broad agreement on the pattern; ongoing debate on boundary conditions.
Known limitations
Local context, culture, and incentive structure all change the strength of the effect.
Open questions
How does Swiss Cheese Model interact with AI-mediated decisions at scale?
References
Meta-analyses
Tracked in the Atlas registry.
Seminal authors
Kahneman, Tversky, Thaler, Ariely, Cialdini, Ostrom, Simon — and the field they built.
Cross references

Every Atlas entry is a node in a knowledge graph. See the related rail below to follow the connections.

Disciplinary layers

See Swiss Cheese Model through 2 lenses

Each layer of the Incentives OS reframes this concept with its own thinkers, vocabulary, and diagnostic question.

Test yourself · 60 seconds

Do you actually know Swiss Cheese Model?

Three quick questions. Result is saved into your review streak — come back when the term is due to lock it in.

Question 1 of 3Score: 0/3

Which best describes Swiss Cheese Model?

Go deeper

Worked example, counter-example & concept map

On-demand AI analysis grounded in the Lab's research. Cached on your device after first run.

How this lands in you

Your nervous system has a region for this.

Primary region
Prefrontal Cortex

When you encounter Swiss Cheese Model, your prefrontal cortex has to do extra work to override the automatic response — and that override budget is finite.

Executive control, planning, impulse override, working memory, System 2. First thing to go offline under stress, fatigue, or low blood sugar. Why your 4pm decisions are worse than your 9am ones.

See Prefrontal in the Brain Atlas →
You may also like

Picked for you, from the Atlas

Ranked by shared learning paths, overlapping chips, and what you've saved.

Share this rabbit-hole

Send the card, not just the link

A pre-rendered social card with the title, eyebrow, and URL. Copy the link, post it anywhere, or download the SVG for slides.

Keep pulling the thread

More definitions to follow

Every term in the Atlas connects to a dozen others. Pick any of these and see where it takes you.

Keep exploring the Atlas
← Browse the full Atlas