Somewhere this week, in a meeting room with a whiteboard nobody has cleaned since March, a decision will be taken about how a system is to be built. Somebody will raise a mild objection, of the sort that would take ten minutes to look into. And somebody else will say: it is state of the art.
The discussion will then be over. The objection has not been answered. The sentence has ended it, which is what the sentence is for, and everybody in the room will feel that something reasonable has occurred.
That thing works so reliably that it repays taking apart. And there is a surprise inside it, which I shall keep until the middle.
Why the Sentence Works
In 1999 two Swedish researchers set light to nobody at all, which is the polite way to run an evacuation study, and watched what people did in a furniture warehouse in Helsingborg. Two exits, equally far away, one of them the door everybody had come in by.
Seventy-one per cent took the door they came in by.
Benthorn and Frantzich published it in Fire and Materials and the finding has held for a quarter of a century. Under time pressure a known route carries no risk of being unknown, and as long as you are alone in the building that sum comes out right. It stops coming out right the moment everybody does it at once.
Four years later The Station nightclub burned down in Rhode Island. The building had four exits. NIST, in its technical investigation, records what happened in a single sentence: "About two-thirds of the occupants attempted to leave through the main entrance; many were unsuccessful." Before ninety seconds had passed, a crowd crush at that door had almost entirely stopped the flow through it. One hundred people died. Two-thirds in the emergency, seventy-one per cent in the drill: the same number, measured once as a preference and once as a cause of death.
And then there are the others. A third of those who got out went through the front windows. There are always a few, the ones who stand still for a second while everybody else runs. Not because they are braver. Because for that second they ask the question nobody else asks.
Hold on to both pictures. The sentence works because it rides on the first one, and the whole argument of this piece rests on the second.
It Was Never About the Technology
There is a comfortable story going round that our present difficulties began with JavaScript. It is a tidy story and it is wrong, and the quickest way to see that is to go back twenty years, before any of the current furniture existed.
A mid-sized firm needed somebody to look after its systems. There was a company that did this properly, that would have written down what it found, that would have charged accordingly and sent an invoice with numbers on it. And there was the owner's son, who was good with computers, obviously, since he played World of Warcraft every evening and could get the printer going again when it was bunged up. He was already at the Christmas party and he would not be invoicing anybody.
You know who got the job. He got it everywhere, for years, and a fair number of those installations are still limping along today, because the data never came cleanly out of the DOS application. It now runs in a virtual machine whose clock has to be slowed on purpose, because the program miscalculates at modern speeds. The complete documentation of this arrangement is a sticky note under the keyboard with the password on it.
Nothing about that decision was technical. The technology it concerned no longer exists. What was actually chosen was the option that required no justification and produced no bill, and it won because those are the two properties an organisation will pay almost anything to obtain.
So when the same firm puts everything in containers today, because that is what one does, it has not learned a new behaviour. It probably picked the idea up over dinner with other owners, or it genuinely believed a sales engineer, dressed like somebody's idea of a reliable son-in-law, about the perfection of the thing on offer. It has found a new object for an old habit.
Underneath sits a remarkable pairing: considerable power to decide on one side, and on the other no idea that a door B and a door C exist at all. Nobody can be blamed for that as a gearbox manufacturer, and the alternatives have anyway only ever appeared as a historical excursion, too far from daily life to turn up as an option. What can be held against them is that the gap is known and nothing happens. They go on deciding rather than asking anybody who knows the other doors.
And who, pray, are the people who go through B?
Three Answers, and Then the Fourth
Ask why a thing was chosen, and you get one of four answers. The first three repay a moment each. The fourth is the reason for this piece.
"It is cheaper." Honourable, because it is a claim about the world and can therefore be checked. In my experience it almost never is. Nobody opens the invoice, finds the egress line and multiplies. The sentence is offered as the conclusion of an arithmetic nobody has performed, and it survives precisely because performing it takes an afternoon and contradicting it takes a career.
"It is more secure." Also checkable, and here there are numbers. A study submitted to arXiv on 2 August 2026 scanned the 52,895 highest-exposure repositories on Docker Hub, together accounting for 84.7 per cent of all recorded pulls, and found that 96.3 per cent of the images carry a known package vulnerability and 93.4 per cent carry a critical one. Sysdig found 87 per cent back in 2023 and the shape has not changed. The reason is not mysterious. Every container ships its own userland, so every container ships its own patching obligation, and a base image is a long-lived thing that everything above it inherits in silence. You did not remove an operating system from the equation. You acquired several dozen, each maintained by somebody else with wildly varying care, and then stopped counting.
"That is how it is done nowadays." A different animal. Notice that it claims nothing whatsoever, and therefore cannot be contradicted. What it does instead is move the burden of justification onto a body with no address: an anonymous everyone, who cannot be summoned to the meeting and cannot be held to account afterwards. It is an indemnity rather than an argument, and it works beautifully, because when the thing eventually falls over, whoever said it was demonstrably doing what everybody else was doing. It is therefore the favourite, since it permits one to wash one's hands afterwards.
"It is state of the art." And here the floor gives way.
The Surprise
"State of the art" is not a compliment. It is a legal test with a definition, and the definition does not say what the speaker believes it says.
The phrase sits in Article 32 of the GDPR, which requires appropriate security measures "taking into account the state of the art". It sits in Article 21 of the NIS2 Directive in the same words. And it binds well beyond Europe, since the GDPR applies to anybody offering goods to people in the Union or monitoring their behaviour, wherever they happen to sit.
What the phrase means is defined by none of those laws. The fullest guidance comes from the German association TeleTrusT, published jointly with the EU agency ENISA and last revised in September 2025, and it reaches back to the three-stage theory from the Federal Constitutional Court's Kalkar decision of 1978.
At the top of that ladder sits existing scientific knowledge and research, the newest thing that works. In the middle sits the state of the art, defined as the best-performing measure available on the market that achieves the legal protection objective. At the bottom sit the generally accepted rules of technology: the proven, the widespread, the thing everybody does.
The middle rung is what the law asks for.
And now the part that should be printed on a card and handed out at the door. The guideline describes how measures travel between the rungs, and calls it the innovation-related shift. A measure arrives as state of science and research. At market launch it becomes state of the art. Then, "with increasing distribution and market recognition, it will eventually achieve the level of generally accepted rules of technology". The guideline attaches an observation to that bottom stage: such measures "may have weaknesses because attackers have found ways to bypass their protection mechanisms".
Widespread adoption does not raise a measure to the state of the art. The guideline records widespread adoption as the documented way out of it.
So the sentence used to close the discussion is the sentence that would lose the argument. Somebody says "it is state of the art" while describing the bottom rung, in defence against a standard that asks for the middle one. A glorious kerfuffle, and nobody in the room notices, because everybody in the room believes the phrase means "modern".
The ladder is German in origin, and anybody sitting outside its reach may take it for a local eccentricity. The thought behind it is older and more widely held. In 1932 an American appellate court heard the case of The T.J. Hooper, two tugs that had lost their coal barges in a storm. They carried no radio receivers on which they might have heard the weather warning. The owners defended themselves on the ground that hardly anybody in their trade carried radio receivers, which was true. Judge Learned Hand declined to accept it and wrote a sentence that has been in every liability textbook since: a whole calling may have unduly lagged in the adoption of new and available devices, and courts must in the end say what is required.
Industry custom has never been a defence, in any legal system worth the name. The reason is plain. Allow it, and any trade could set its own standard of care by mere habit, and the more people did something wrong, the more lawful it would become. That describes the behaviour of lemmings rather than of professionals.
Which fits rather well, since that picture is also something everybody knows and which is not true. Lemmings do not throw themselves off cliffs. The famous footage comes from a Disney film of 1958, shot in Alberta, where no lemmings live; the animals had been bought from Inuit children in Manitoba and were thrown over the edge for the camera. The film won the Academy Award for Best Documentary Feature. The whole thing was exposed in 1982, and the comparison has survived ever since on nothing but circulation.
If that stung slightly, you have just felt the mechanism from the inside, which saves me a paragraph of explanation.
What the Sentence Costs
A sentence that ends discussions leaves a bill. Two places to look for it.
The first is what gets cut. When the budget tightens, three things go with remarkable reliability. Security work. Documentation. Backup. A fourth never even comes up for cutting, namely the question of whether the whole thing could be smaller. Your list is probably longer than mine.
They share a property that makes them hard to defend in a meeting: when they work, nothing happens. A backup that was never needed looks exactly like money set on fire. Documentation nobody had to read looks like bureaucracy in a nice font. A month spent hardening a system that was then not breached produces, as its complete and final output, an ordinary Tuesday. Their entire success consists of the absence of a story, and no organisation on earth has ever promoted anybody for an absence.
A security lock, by contrast, can be touched. You see it, you hear it engage, and it promises protection in a way that makes immediate sense, even though nobody has ever tried the door. The colleague who prevents an incident that has never occurred has nothing anybody can touch. He is standing at the coffee machine, and whoever sees him there sees somebody fetching coffee. On the ledger where the lock is entered, he never appears at all.
Two of those cuts are not optional, incidentally. Article 32 of the GDPR requires "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident", which is the backup, spelled out, in law. It also requires "a process for regularly testing, assessing and evaluating the effectiveness" of the measures, which is the documentation, spelled out, in law. Both were already compulsory while they were being cut for looking unproductive.
The second place to look is the onion. Where two administrators ran a system, eight people with new titles work today. They keep alive an orchestration introduced to manage containers, which were introduced to manage dependencies, which were introduced because nobody knew any more what was on the machine. Every layer reliably solves a problem, and every layer creates the problem the next one is needed for.
How well that works can be measured. Cast AI measured tens of thousands of production clusters on AWS, GCP and Azure, before any optimisation, and arrives at eight per cent average CPU utilisation. Memory sits at twenty per cent, graphics processors at five. More troubling than the values is their direction: the year before it was ten per cent for CPU and twenty-three for memory. It is getting worse while everybody involved is getting more experienced. Sixty-nine per cent of clusters are over-provisioned on CPU, against forty per cent the year before, so over-provisioning is spreading rather than receding.
Ninety-two per cent of provisioned compute sits idle, and it does not sit idle for free. It sits in data centres whose electricity consumption the International Energy Agency puts at 565 terawatt-hours for 2026, doubling by 2030 in the base case. The driver of that growth is avowedly artificial intelligence rather than orchestration, and that belongs in the record. The question of how many of those halls would be unnecessary if the machines beneath them were not holding ninety-two per cent air is nonetheless rarely asked.
In fairness: Cast AI sells optimisation software and measures at the least flattering point. Read the figures as an upper bound. The upper bound is remarkable enough.
The Limit
Now the honest part, because the opposing case is strong and leaving it out would be cheap.
Choosing what everybody else chose is frequently right, and for reasons you can list. You can hire for it. The answers exist. When something breaks at two in the morning, somebody has already written up the fix, and a technology with ten thousand eyes on it gets its security patches faster than your bespoke arrangement ever will. Popularity is not merely fashion; it is also a real, measurable form of support, and claiming otherwise is romanticism.
The snag is that the same choice feels exactly as right when not one of those reasons applies. The feeling comes from the circulation and not from the reasons, and from the inside the two cases are indistinguishable.
The alternative has its price too. An organisation that reopens every decision from first principles does not become rigorous, it becomes slow, and after that it becomes an organisation that decides nothing at all. Dan McKinley's innovation tokens exist for exactly this reason. Convention is what buys the attention you then spend precisely where it counts most.
The container figure needs its counterweight as well. Those 96.3 per cent describe what sits in the registry, not what is exposed at runtime, and Sysdig's most recent report puts critical and high vulnerabilities actually reachable at runtime below 6 per cent, a 64 per cent improvement over two years. Many teams now discharge the obligation properly. Two things remain true: it was acquired without being noticed, and discharging it is paid for in people and in compute that appear on no slide.
Nor is the rest of the picture uniformly bleak. Sophos surveyed 2,158 IT and security leaders across 17 countries whose organisations had been hit by ransomware in the past year, and found backup-based recovery used in 66 per cent of encryption cases, up twelve points on the year before. People are getting better at the boring thing. Two thirds still leaves a third, and it is movement in the right direction.
The complaint is not with the popular choice. It is with the sentence that arrives instead of a reason.
The Point
So how does one get out of this?
Not through the market. An industry lives by working on problems, not by ending them and having none left. A definitively solved problem is a discontinued product, a cancelled maintenance contract, a sales territory without an object. Nobody need be credited with bad intent; it is enough to look at what counts as success in a quarterly report and what does not appear there at all. Considered work cannot be bottled into licences either, because it consists mostly of the working hours of knowledgeable people and must be done afresh each time. What can be bottled and shipped a million times is the next layer.
And the line about it being nobody's intention holds only at the right level. Whoever plans a product whose revenue depends on a recurring payment plans, along with it, the condition that makes the payment necessary. This is no conspiracy and needs saying nowhere. It suffices that a roadmap must generate follow-on demand in order to be approved. One level down the same structure looks like a series of excellent tools, and whoever works there plays along, either because nobody ever explained how it looks from above, or because it gets them finished sooner today and the bill arrives in three years at an address that will probably not be theirs.
Nothing is coming from that direction. Which leaves the room itself.
At this point somebody usually objects that all of this is deeply human.
The people in Rhode Island had ninety seconds, choking smoke and mortal fear. A third of those who got out went through the windows anyway. They had the same ninety seconds.
Nothing is burning in the meeting. It is warm, there is coffee, an hour is booked in the calendar, and the only smoke in the room comes from the presentation. Anybody who takes the same door under those conditions is invoking that reflex without being entitled to it. The difference between those two rooms is precisely what decision-makers are paid for. Not for finding the right door in mortal fear, but for looking, in the light and at leisure, to see where the others are.
They exist in every room, the ones who go through the windows. The colleague who asks for figures. The developer who wants to know who selected this. They are the proof that it could be done, and they are the first to be told that this is simply how it is done nowadays.
The question that helps costs nothing, so long as it comes early: what would we have to see for this to be the wrong choice? It becomes expensive only for whoever asks it. That the cheapest question in the room carries the highest personal price is not a constant of nature. It was made, it is maintained, and it is maintained by the same people who will later explain that nobody could have known.
That is as far as I get, and I am not being coy about it. If you can see a way out of the onion that does not consist of another layer, I should genuinely like to read it.