An incident teaches you about the failure modes that crossed the threshold into actual production impact. A near-miss teaches you about the failure modes that almost did — and those are often more valuable, because you get the signal without the cost of the failure. The problem is that most operational processes are structured around incidents, not near-misses. If something broke, you write a post-mortem. If something almost broke but didn’t, the signal disappears.

This is a systematic bias in how teams learn from operational experience. You end up with rich documentation of the failures that broke through and very little documentation of the risks that were present but happened not to trigger. Over time, your operational improvements cluster around the incident patterns that are over-represented in your post-mortem archive, while the near-miss patterns — which might be more frequent or more dangerous — go unaddressed because they left no record.

The near-miss signal is especially high-value in a few specific scenarios. When something is caught by a failsafe that was designed exactly for that case, that’s evidence the failsafe is working — but it’s also evidence that the upstream condition the failsafe was designed to catch is still occurring. When an operator manually intervenes to prevent a failure, that’s evidence of judgment being applied to a gap in the automated system. When two independent failures would have combined into an incident but one of them resolved first, that’s evidence of a latent interaction that could still occur. None of these become incidents; all of them represent risk worth understanding.

The fix doesn’t require full post-mortem process for every near-miss — that would be too high a bar and would go unused. What works is a lightweight near-miss log: a place where anyone can record in a few sentences what happened, what could have gone wrong, and what prevented it. No required root cause analysis. No required action items. Just enough to preserve the signal and make it searchable later. The goal is to capture the pattern across multiple near-misses, not to deeply analyze any single one.

Over time, the near-miss log tends to reveal things that incident post-mortems don’t: which failsafes are working and being exercised regularly, which manual interventions are recurring often enough to suggest the automated system has a gap, which combinations of conditions keep nearly coinciding. This is operational intelligence that you can’t get from incidents alone, because incidents are the sample that made it through the filter. The near-miss log is everything that nearly made it through — and that’s often where the next incident is already forming.