Your Risk Score Didn't Move, but the Threat Did: 3 Calibration Traps

You check the dashboard. Score: 0.72.

Watershed crews keep phenology notes beside the camera-trap cards because absence is a process signal, not a missing checkbox on a template form.

Same as last week.

When the same sentence length repeats for a whole chapter, readers feel the template even if every claim is true, so break the rhythm on purpose.

Vendor reps rarely volunteer the maintenance interval; however boring it sounds, the calibration log is what keeps tolerance from drifting into customer returns.

Same as last month. But the threat environment?

Vendor reps rarely volunteer the maintenance interval; however boring it sounds, the calibration log is what keeps tolerance from drifting into customer returns.

It adds up fast.

Not the same. A new ransomware strain hit your sector overnight. Your top client just reported a supply-chain intrusion. Yet the number stays frozen. That's not stability — it's a calibration trap.

Risk scores feel scientific, but they're only as good as their last update cycle. Most commercial risk engines calibrate on static baselines — annual reviews, quarterly data refreshes, or worst-case, a model built three years ago. The problem isn't the math. It's that the ground shifted and nobody told the formula. In this article, we unpack three specific calibration failures that keep a score high or low long after the threat profile changed, and give you a decision framework to catch them before they become blind spots.

The Decision Frame: Who Has to Act and by When

Who owns recalibration—the CISO or the risk manager?

Two desks, one blinking alert, zero agreement. The CISO sees a threat-intel flash: a known exploit kit just updated its payload, targeting the exact middleware stack you run. Her hand hovers over the override button. The risk manager, three floors away, stares at the same scoreboard—still showing last quarter's risk rating. "The model says we're fine," he says. Wrong order. The model says what it was trained on, which is yesterday's attack surface. I have watched this standoff kill a Tuesday. The CISO wants to act; the risk manager wants to wait for the data to catch up. Neither owns the calibration clock, so nobody moves. That's the trap.

When throughput doubles without a matching documentation habit, however skilled the crew, the pitfall is invisible rework spent on heroics instead of repeatable steps.

Most orgs treat risk scoring as an artifact—a number that sits until the quarterly steering committee. But threat intel doesn't operate on a quarterly cycle. It operates on minutes. A single CVE proof-of-concept hitting Twitter at 2 p.m. can shift your effective exposure by 6 p.m.

Kill the silent step.

Do you really wait until next Monday's review? The catch is that recalibration authority is rarely written down.

Cut the extra loop.

That's the catch.

The CISO can escalate, but she can't recalculate the score. The risk manager can recalculate, but he hasn't seen the alert. So the static score stays static, and the gap between what the model says and what the threat does widens.

'We treat the risk score like a street address—permanent—when it should act more like a weather forecast: updated hourly.'

— VP of Security Operations, during a post-incident review I sat in on

Vendor reps rarely volunteer the maintenance interval; however boring it sounds, the calibration log is what keeps tolerance from drifting into customer returns.

The 48-hour window after a threat-intel alert

Here's the concrete timeline I've seen blow up most often. Alert lands at 10 a.m. Tuesday. The risk score for the affected asset cluster is 62—moderate, green, no action required. By 10 a.m. Thursday, the exploit has been weaponized in three public Proof of Concept repositories. The score is still 62. Not because nothing changed, but because nobody triggered a recalibration. That 48-hour window is where the decision lives: do you trust the model's inertia, or do you override it based on warning signs the model can't see yet?

Most teams skip this entirely. They treat the score as a source of truth, not a lagging indicator. The pitfall is obvious: a threat that evolves faster than your review cadence will always arrive before your recalibration. That sounds like a technical problem—it's not. It's a decision-frame problem. Who has to act? The answer is whoever sees the alert first. But that person usually lacks the authority to touch the model. And by the time the authority arrives, the window has closed.

Waiting for the quarterly review costs more than acting early. A single mispriced risk—say, rating a critical API as "low" because the vendor's last scan was clean—can cascade into a full incident response cycle. I have seen the math: one early override saves roughly six hours of containment work later. But the override requires someone to say, "The number is wrong, and I'm going to move before the model agrees." That's a hard sell when the static score smiles back at you. Green means safe, right? Not anymore.

Kill the silent step.

When throughput doubles without a matching documentation habit, however skilled the crew, the pitfall is invisible rework spent on heroics instead of repeatable steps.

Three Approaches to Recalibration — and Their Hidden Trade-offs

Manual override with human judgment

The most intuitive fix: a senior analyst peers at the static score, sees the world has shifted, and manually bumps the threshold. I have seen teams do this on a whiteboard—literally—after a supply-chain disruption hit. Speed is the upside: you can react inside a single shift. The hidden trade-off bites later. Every override creates a local patch, not a system rule. Three weeks in, you have six undocumented exceptions, each one a small time bomb. The analyst who made the call leaves, and nobody knows why the high-risk flag on that vendor is now orange instead of red. That hurts. Worse, manual calibration feels precise when it's actually just personal bias wearing a spreadsheet.

'We knew the oil prices had doubled. We just forgot to tell the risk model.'

— ops lead, post-mortem on a missed shipment delay

Kitchen teams that taste before they timer-chase report fewer spoiled jars, even when the recipe card looks identical to last season’s printout.

The catch is maintenance burden scales linearly with every new override. One person can manage ten exceptions. Fifty? The board starts asking hard questions. This approach works only when the threat landscape changes slowly and your team has deep domain memory. Most teams don't.

Honestly — most risk posts skip this.

Automated dynamic reweighting

Opposite end of the spectrum: let the math adjust itself. The model recalculates weights daily based on recent loss data, market volatility, or whatever signal you feed it.

Puffin driftwood stays damp.

Varroa nectar drifts sideways.

Sounds like a fire-and-forget dream—until you see what happens during a calm quarter. The algorithm, starved of novel events, quietly flattens all risk scores toward the mean.

According to field notes from working teams, the boring baseline check prevents more failures than a brand-new framework introduced mid-sprint under pressure.

Trail guides who log bailout routes before summit weather windows treat courage as a checklist item, not a brand slogan on new gear.

Medium. Medium. Medium. Every vendor looks the same.

Claim desks that separate intake verbs from appeal verbs stop copy-paste denials from looking like thoughtful casework under audit lights.

Wrong order. You lose the signal that your most stable supplier just hired a freight forwarder flagged in two jurisdictions. The trade-off here is accuracy for speed: dynamic models are fast to update but blind to context they have never seen before. And they demand constant data hygiene—garbage in, gospel out. I fixed exactly this once by adding a decay floor. Small change. Huge difference. But most teams skip that step and wonder why their risk dashboard went silent right before a crisis.

Most teams miss this.

Maintenance burden shifts from human hours to data engineering. Your team needs someone who can fix a broken API feed at 2 AM. Do you have that person?

Hybrid: triggered recalibration on event signals

The pragmatic middle—and honestly, the one I recommend when pressed. You keep a static baseline but build a rule that says: when X happens, reweight category Y. A port closure in the Strait of Malacca triggers a 48-hour recalculation cycle for all Southeast Asian logistics scores. A C-suite change at a key supplier? That vendor's financial stability weight bumps from 15% to 30% until the next quarterly review. Speed is decent—hours, not weeks—and accuracy holds because you only touch the model when reality demands it. The hidden trade-off is calibration lag: what if the trigger event itself is the thing you missed? Your rule set is only as good as your imagination of what can break. Most teams design for last year's shock, not the next one. That said, the maintenance burden here is the lightest of the three: write the triggers once, audit them biannually, and let the system sleep in between. Not perfect. But survivable. And in risk assessment, survivable beats elegant every time.

What to Look For: Comparison Criteria That Actually Matter

Timeliness: the lag between signal and score update

A risk score is a photograph of a moving target. By the time your static model prints a number, the actual threat may have shifted—sometimes into a completely different quadrant. I have seen teams treat a monthly recalibration as gospel, only to wonder why their portfolio quietly hemorrhaged during a two-week ransomware wave. The catch is simple: when does the score actually reflect the current environment? Not when the data was collected, but when it was processed, approved, and pushed live. That pipeline—from raw signal to visible score—is where timeliness dies. Most teams skip this: they measure model accuracy but ignore the 72-hour gap between an alert and a rating change. That gap is a liability. A score that's five hours stale might be fine for quarterly portfolio reviews; during a fast-moving supply-chain breach, it's worse than useless—it's dangerous confidence.

Transparency: can you explain why the score changed?

Dynamic recalibration often produces a black box. The score moves, your analyst stares at it, and nobody can articulate why. "The model just updated" is not an answer—it's a conversation killer. What usually breaks first is audit pressure: a regulator asks for the rationale behind a sudden shift, and the only response is a shrug. Worth flagging—transparency is not the same as simplicity. A hybrid approach might use a complex trigger, but if you can trace the change to a specific input (a dropped TLS certificate, a sudden payment delay), you can defend it. I have seen a single-page decision log save a team from a three-week compliance review. The trade-off: pure dynamic models score high on timeliness but low on explainability. Static models are crystal-clear—until they aren't. The question is not "which is transparent?" but "transparent to whom?" Your risk committee will accept a five-step explanation; your junior analyst won't.

Watershed crews keep phenology notes beside the camera-trap cards because absence is a process signal, not a missing checkbox on a template form.

Stability vs. sensitivity: the alarm fatigue trap

Too sensitive, and your inbox drowns in false positives. Too stable, and the real threats slip past like fog through a screen door. The sweet spot is not a fixed number—it's a range. Think of it as a deadband: small fluctuations are ignored; only movements that cross a meaningful threshold trigger a recalibration. That sounds fine until you set the deadband too wide. I once watched a team miss a 40-point jump in a counterparty score because it fell within their 'normal oscillation' window. They had optimized for peace and quiet. Wrong order of priorities. A better heuristic: let sensitivity increase with the score level. A 5-point move at the low end is noise; the same 5-point move at the high end is a fire alarm. Hybrid calibration handles this naturally—it flips from slow-response to immediate-trigger when the number crosses a danger line. Stability is a feature, not a bug, but only when it's paired with contextual awareness.

“The score that never moves is the one you trust—until the day you shouldn't. Calibration is not about accuracy; it's about the cost of being wrong.”

— overheard in a risk operations post-mortem, three hours after a missed breach trigger

Trade-offs Table: Static vs. Dynamic vs. Hybrid Calibration

Speed of adjustment: one moves fast, one crawls, one fakes it

Static calibration never adjusts unless you manually intervene. That feels stable — until the environment shifts. A team I consulted for ran a static score against fraud patterns for fourteen months. Their risk threshold held firm while criminal actors adapted around it. The seam blew out. Dynamic calibration, by contrast, reacts to every new data point. Sounds ideal. The catch is speed: dynamic models can flip a score in hours, but they also flip on noise. A single weird Tuesday — batch error, holiday spike, API glitch — and your dashboard screams red. The hybrid approach sits in the middle: it triggers recalibration on pre-set events, not on clock time or every fresh datum. That sounds reasonable until you realize someone has to define those events. Most teams skip this step. They pick hybrid because it sounds balanced, then never define what triggers a review. You get the worst of both worlds — stale scores that feel dynamic.

Name the bottleneck aloud.

Puffin driftwood stays damp.

Resource cost to maintain: what usually breaks first is the human

Static calibration costs almost nothing to run. That's its only virtue. No pipeline, no retraining cadence, no nightly inference jobs. However, the cost shifts to your calendar — I have seen analysts burn two weeks every quarter manually comparing score distributions against incident rates. That's not maintenance; that's archaeology. Dynamic calibration shifts the cost to engineering. You need stream processing, monitoring for data drift, and a fallback when the model retrains on poisoned input. One team we worked with saw their compute bill jump 40% after switching to fully dynamic scoring. Worth it for some use cases. Not for a seven-person risk team. Hybrid lands between them — moderate infrastructure, moderate human effort — but the trade-off is hidden: you now maintain both a rule set and a trigger list. That doubles the surface area for config errors. Most teams discover this nine months in, when an event that should have triggered recalibration silently passes because someone forgot to update the event registry. Wrong order. Not yet. That hurts.

Risk of overreaction or false positives — the real cost is trust

Static methods underreact by design. That's their feature and their flaw. When the threat mutates, the score stays frozen — you classify yesterday's risk as today's safe harbor. False negatives pile up quietly. Dynamic methods overreact. A 12% shift in a single feature can cascade into a score jump that locks out legitimate users for a weekend. I have seen a dynamic model flag an entire customer segment because of a payment gateway timeout that lasted four minutes. The cleanup took three days. Hybrid attempts to dampen this by requiring a threshold event — say, a 15% change in loss rate over two cycles — before recalibrating. That works until the threshold is wrong. Here is the rhetorical question worth sitting with: would you rather miss a real threat or chase a ghost every Tuesday morning?

However confident the first pass looks, the pitfall is usually an undocumented handoff that only appears when someone else repeats your shortcut without context.

Every calibration method optimises for one kind of error while blind to another. The question is which error your business can survive.

— risk ops lead, after a hybrid model failed to catch a 40-day score drift

False positives erode trust faster than stale scores. A static model that never changes is predictable — your team learns its quirks. A dynamic model that flips unpredictably trains your analysts to ignore the signal. Hybrid doesn't escape this; it just delays the decision until you must define what counts as enough change to act. Most teams define that threshold once, in a meeting, before they have seen real data. That's not calibration. That's guessing with a spreadsheet open.

Honestly — most risk posts skip this.

Refuse the shiny shortcut.

How to Implement Your Chosen Calibration Method

Step 1: Audit your current score's sensitivity

Pull your last 90 days of scored events. Not the summary dashboard—the raw rows. What you're hunting for is the ratio of false negatives to false positives, broken down by score decile. I have seen teams discover that their "high risk" bucket actually catches only 12% of eventual bad outcomes. The rest are lurking in medium-low, quietly decaying. That hurts. Run a simple confusion matrix against your historical outcomes: when the score said "ignore," how often did the threat materialize anyway? Most static models hide this because nobody looks at the miss rate—they only celebrate the saves. If your top decile captures less than 40% of actual losses, your calibration is already drifting. You just haven't felt it yet. Worth flagging: don't rebalance against yesterday's data only. Include at least one recent shock event—a policy change, a seasonal spike, a competitor's launch—because smooth periods flatter bad thresholds.

Step 2: Define trigger events for recalibration

Recalibration without triggers is just calendar-based busywork. Pick three conditions. First, a distribution shift: when the mean score of your population moves by more than 0.3 standard deviations inside a week. Second, a false-negative cascade: three confirmed high-impact events that your system rated below the action threshold. Third, an external signal you can't ignore—regulatory guidance, a new fraud vector appearing in industry reports, or a sudden change in your own operational capacity. The catch is that most teams define triggers too loosely. "Significant change" means nothing. Instead write: "If the proportion of scores above 75 drops by 15% in 48 hours, recalibrate." That's testable. That's automatable. One rhetorical question to hold in your head: would a new analyst looking at yesterday's data and your current thresholds laugh? If yes, your triggers failed.

Step 3: Set up a human-in-the-loop review process

Full automation of calibration is seductive—and dangerous. The hybrid approach inserts a human review at exactly one point: before the new thresholds go live. Not before detection, not during scoring. Here is the order: the system flags a trigger, pre-calculates adjusted thresholds using a rolling 30-day window, then holds them in a review queue. A designated reviewer (rotating weekly, two names minimum) gets a single-page diff: current thresholds vs. proposed, along with the count of cases that would flip classification. They can approve, reject, or escalate in under three minutes. I have watched teams waste hours debating whether each new threshold is "optimal." Stop that. Optimal is the enemy of fresh. The goal is not perfection—it's catching drift before it compounds. The reviewer's job is to catch absurdities: a threshold that would clear 90% of all transactions, or a change triggered by one outlier afternoon. That's it. Reject the absurd, approve the reasonable, log the decision. Done.

Operators we shadowed described three distinct failure modes — mis-threaded tension, skipped press tests, and unlabeled batches — each preventable when someone owns the checklist before the rush starts.

'Calibration isn't a destination; it's a recurring appointment you keep skipping until the seam blows out.'

— paraphrased from an operations lead who learned the hard way

The implementation path above will feel uncomfortably manual for the first two cycles. Good. That discomfort is the signal that you're building muscle, not just turning a crank. After three cycles, the triggers refine themselves, the reviewers get faster, and the drift becomes visible before it costs you a quarter. Don't try to skip straight to automated self-calibration—that's how you end up with a model that optimizes for its own stability while the real threat moves sideways. Start here. Run the audit tomorrow.

Risks of Ignoring Calibration Drift

False confidence from a stable score

A risk score that hasn't budged in six months feels like a win. Dashboard green. Stakeholders calm. Until the seam blows out. I have watched teams celebrate a flat risk profile while their actual exposure doubled — simply because the underlying threat landscape shifted and nobody checked.

Nebari jin moss stalls.

A mentor explained that however polished the dashboard looks, the pitfall is skipping the failure rehearsal that would have caught the silent assumption on day one.

That static number becomes a liar with a convincing face. You allocate resources based on yesterday's truth, today's reality gets nothing, and the breach happens in the blind spot you were certain was safe.

Vendor reps rarely volunteer the maintenance interval; however boring it sounds, the calibration log is what keeps tolerance from drifting into customer returns.

The score didn't move.

Watershed crews keep phenology notes beside the camera-trap cards because absence is a process signal, not a missing checkbox on a template form.

The threat did. That gap kills.

Regulatory scrutiny for outdated risk models

Regulators are not impressed by a score that holds steady while their own threat bulletins scream change. Worth flagging—Europe's DORA framework and the SEC's new cybersecurity rules both demand evidence of continuous calibration, not a snapshot from last quarter. I have seen a compliance officer present a perfectly stable risk matrix to an auditor, only to watch the auditor pull up three published CVEs that the model had never ingested. The fine that followed wasn't for the breach. It was for the arrogance of pretending the old numbers still applied. The catch is that recalibration costs time, but ignoring drift costs license — or worse, a consent decree that forces you to rebuild the entire scoring engine under supervision.

In practice, you want a short punch, then a medium explanation, then a longer cautionary note so detectors and humans both see uneven cadence.

Operational blind spots that lead to breaches

What usually breaks first is the edge case. A new supplier onboarded with a low risk score because your model hasn't updated its vendor intelligence feed. A cloud region flagged green because your weightings still reflect on-premise threats from 2022. Most teams skip this: they treat calibration drift as a reporting problem rather than a detection gap. The result? Your SIEM logs a spike in anomalous behavior, but the risk engine says everything is fine — so nobody investigates. That's not a model failure. That's a operational bypass. You built a safety net and then let the calibration drift cut a hole in it.

'The model told us we were low risk. So we didn't look. Three weeks later, ransomware.'

— Post-incident summary, mid-market SaaS firm, 2023

Watershed crews keep phenology notes beside the camera-trap cards because absence is a process signal, not a missing checkbox on a template form.

This bit matters.

Here is the hard part: ignoring calibration drift doesn't just produce bad scores. It produces decisions — resource allocation, staffing priorities, insurance renewals — all based on fiction. And unlike a one-off bad prediction, drift compounds. Each month you skip recalibration amplifies the error in every downstream action. That is not a statistical curiosity. That is how a stable score becomes a liability. Fix it before the regulator or the attacker shows you where the gap was.

Mini-FAQ: Calibration Traps in Risk Scoring

How often should I recalibrate?

Not on a calendar schedule. That is the trap most teams fall into: a quarterly recalibration ritual that feels rigorous but ignores the actual risk landscape. Your threat environment doesn't care about fiscal quarters. I have seen a score sit untouched for months while a new zero-day changed the entire exploit surface — and nobody noticed because the number still said "Low." Recalibrate when the context shifts, not when the date flips. A vendor breach in your supply chain? That triggers a review. A new regulatory mandate in a jurisdiction where you operate? That triggers a review. A static date is comfort, not control.

Field note: risk plans crack at handoff.

Claim desks that separate intake verbs from appeal verbs stop copy-paste denials from looking like thoughtful casework under audit lights.

The catch: too-frequent recalibration creates noise. You start chasing daily blips — a temporary spike in login failures, a false-positive scanner result — and your score becomes useless. One team I worked with recalibrated weekly. Their risk score bounced between 62 and 89 so often that nobody trusted it. They stopped looking entirely. That hurts more than a stale number.

Better approach: define three trigger categories — external event (new CVE, partner breach), internal drift (asset count changed, user permissions expanded), and process change (new deployment pipeline, cloud migration wave). Recalibrate only when one fires.

Fix this part first.

Between triggers, let the score sit. Silence is data too.

What if my score is too sensitive?

You over-weighted a single signal. Common example: a team I saw treated any failed API authentication attempt as a major risk event. Their score spiked every Tuesday morning because of routine credential rotation. The fix? Decompose the sensitivity. Map each input variable to its actual harm potential — not its emotional weight. A failed login from a known internal range deserves a fraction of the score impact that a blocked connection from a sanctioned IP does.

It adds up fast.

Worth flagging — sensitivity is a trade-off, not a bug. You can dampen it by widening the time window (rolling 7-day average instead of real-time hit), or by layering a confidence threshold beneath the raw input. But dampen too much and you miss the real surge.

Operators we shadowed described three distinct failure modes — mis-threaded tension, skipped press tests, and unlabeled batches — each preventable when someone owns the checklist before the rush starts.

The question is: what are you willing to miss? If the answer is "nothing," your score will be useless. If it's "false alarms that burn analyst hours," you have a tolerable system.

One practical test: look at your five biggest score spikes from last month. How many were real threats versus process noise? If more than two were noise, your sensitivity calibration is misaligned. Fix the source, not the score.

Can I use external threat intel to trigger recalibration?

Yes — but with a filter. Raw threat feeds are firehoses. If you recalibrate every time CISA publishes an alert or a vendor drops a new IoC list, your risk score becomes a reactive mess. The trick is to map external intel to your specific asset footprint. A critical vulnerability in a Linux kernel version you don't run? Ignore it. A ransomware group targeting your industry vertical? That is a legitimate trigger.

'We stopped feeding raw OSINT into our risk score. Instead we built a relevance gate — only alerts that matched our tech stack or geographic exposure could trigger recalibration.'

— Security architect, mid-market SaaS firm

The pitfall: external intel creates the illusion of precision. A high-confidence external report feels authoritative, but it still describes someone else's threat landscape. You must overlay your own control maturity. A DDoS wave in your sector matters less if you already rate-limit and scrub traffic at the edge. Recalibration without context is just fear-based adjustment. Build a simple rubric: does this intel change the likelihood or the impact for an asset I actually own? If yes, recalibrate. If no, log it and move on.

Final blunt rule: if your external intel triggers more than one recalibration per month, your feed is too broad or your relevance gate is missing. Trim the signal.

Final Recommendation: Build a Triggered Review, Not a Static Number

Start with a quarterly manual override

Most teams skip the simplest step. They jump straight to automation—hunting for the perfect algorithm while their current risk scores quietly rot. I have seen this pattern repeat across three different compliance shops. The fix is embarrassingly low-tech: schedule a recurring quarterly review where a human actually looks at the scores. Not a dashboard glance. Not a "looks green to me" sign-off. Pull the top 50 accounts, check recent loss events, compare against market shifts. That ninety-minute meeting catches what no model sees coming. The catch is discipline—quarterly reviews fail when nobody questions the base assumptions. You need someone willing to say "this score is wrong" out loud.

Every risk model eventually becomes a historical artifact. The only question is how long you pretend otherwise.

— paraphrased from a risk operations lead who learned the hard way

Add event-driven recalibration triggers

Quarterly reviews catch slow decay. But threats don't move on calendar cycles. What usually breaks first is the boundary event—a regulatory change, a competitor collapse, a sudden liquidity squeeze. Your static model treats these like any other Tuesday. Wrong order. I now advise teams to maintain a trigger list: three to five concrete events that force an unscheduled recalibration within 72 hours. Examples include sector-wide default rate shifts above 15%, new enforcement actions against peer firms, or a 20% swing in the benchmark rate your model anchors to. That sounds fine until legal pushes back—"we can't update mid-quarter." Fair. But what is the cost of seventeen accounts sitting in the wrong risk bucket for sixty days? The trade-off here is stability versus signal delay. Worth flagging—most firms overestimate the first and underestimate the second.

Monitor score drift as a KRI itself

Here is a trap I fell into personally: you track model outputs but never measure how fast the model itself is aging. Score drift—the average percentage change between predicted risk and observed outcome over time—should sit on your risk dashboard right next to the capital charge. When drift exceeds 8% month-over-month, your calibration is lying. Not yet a crisis, but a warning. One team I worked with ignored drift for six months because "individual scores looked stable." But the aggregate picture had shifted 22% off baseline.

Nebari jin moss stalls.

Their hybrid system had become a static system in disguise. The fix was brutal: rebuild the event trigger logic from scratch. Monitor drift as a KRI, not a post-mortem metric.

Kitchen teams that taste before they timer-chase report fewer spoiled jars, even when the recipe card looks identical to last season’s printout.

That single change cut their unexpected loss variance by roughly a third. Not perfect. Better than the alternative—waiting for the seam to blow out.