Normalization of deviance

Dan Luu argues that engineering organizations often normalize risky practices that seem routine to insiders but are alarming to outsiders, and that software companies should learn from the "normalization of deviance" concept used in healthcare, aviation and engineering. He cites examples including a company that loses about half its new hires in the first year, a firm where a bug-fix policy and secrecy rules are considered normal, and a company with 2 9s of reliability. He says companies focused on growth early often keep that culture after becoming large, and that Google and Microsoft improved security only after public embarrassments forced change. He also cites hand-washing studies, noting that enforcement at code review helps more than telling people to follow practices.