Riverman’s Principles for Filling in the Gap
In industrial operations and cybersecurity, we spend a lot of time chasing noise: alarms, warnings, red lights. But after years on the ground, you start to realize that sometimes, the most telling sign of trouble is what isn’t there. Like Sherlock Holmes’ famous case, it’s often the “dog that didn’t bark” that reveals what’s truly at risk.
What is the "Dog that Didn't Bark"?
It comes from a Sherlock Holmes story. There was a theft, but the guard dog didn’t bark. Holmes figured out that the only reason the dog stayed quiet was because it knew the person.
So, the clue wasn’t something that happened,it was something that didn’t happen.
The Hidden Threats of Absence
Industrial environments are a symphony of data. Sensors report, systems log, controllers communicate, backups run. We’re taught to watch for spikes, outages, failures, but what about when expected signals simply vanish? It’s easy to overlook the gaps, yet these silences can be the first signs of deeper issues.
A PLC might stop communicating, quietly dropping out of the background hum. A historian suddenly has no new records, but throws no error. A backup job never runs, so nothing fails—but nothing is protected. A sensor goes dark, leaving a blind spot in your environmental awareness.
These aren’t just technical glitches. They are the spaces where risk accumulates, where small oversights can grow into big problems.
Riverman’s Principle: Fill in the Gap
Resilience isn’t just about responding to alarms. It’s about cultivating the discipline to notice what’s missing.
1. Know What “Normal” Sounds Like
The first step is operational intuition. You can’t spot a missing note if you don’t know the tune. Understand what data, logs, and signals normally flow through your environment across shifts, seasons, and operating modes. Map out the expected rhythm of your systems.
Ask yourself:What devices should always be present on the network? What logs, reports, or metrics are expected at regular intervals? What environmental conditions are considered “normal” for your process?
2. Don’t Just Collect Data. Observe Patterns of Presence
It’s not enough to gather terabytes of data. Pay attention to the pattern of reporting, not just the values but the fact that they appear at all. Is your monitoring approach sensitive to silence, not just noise?
Are you alerted if a data stream stops, not just if values go out of range? Can you tell when a system or sensor quietly drops offline? Do you have visibility into the “heartbeat” of your infrastructure?
3. Design for Gaps. Expect the Unexpected
The real world is messy. Devices get unplugged, processes change, software updates break reporting. Build your monitoring and review practices to be skeptical of gaps. Assume silence is meaningful.
Regularly audit for devices or signals that have gone quiet. Test your processes by deliberately disabling devices and confirming you get notified. Cross-check reports and dashboards for missing elements. Don’t assume “no news is good news.”
4. Build Cultural Awareness
Technical solutions are only half the story. Teams need the habit of asking, “What am I not seeing?” Encourage reviews and incident post-mortems to consider not just what failed, but what failed to appear. Make filling in the gap part of your operational culture.
5. Document and Communicate the Quiet
Make it easy for your team to know what “should” be there. Document the expected data flows, device lists, and reporting intervals. Share stories internally about incidents caught not by alarms, but by noticing something was missing.
Questions to Ask Yourself
If a critical device or log stopped, how soon would you notice? Are your monitoring and review routines designed to catch absence as well as presence? How do you handle quiet changes? Are they tracked, or do they slip through the cracks? Do your teams treat silence as a signal?
Conclusion: Don’t Just Chase the Noise
Industrial resilience is about more than following alarms and reacting to problems. The best operators and defenders learn to listen for the dog that didn’t bark. They fill in the gap and sense when the pattern is broken not by what’s there, but by what’s missing. That’s where the next generation of operational security and reliability will be forged.
Riverman’s rule: The river’s surface tells a story, but sometimes, it’s the quiet spot in the current that signals trouble beneath. Learn to see the gap, and you’ll be ready for what’s coming.
How do you fill the gap in your operations? What’s the quietest clue you’ve ever caught? Let’s share lessons and keep each other sharp.