A 2009 study found a positive correlation between ice cream cone sales and murder rates. A 2006 survey connected ice cream consumption to drowning deaths. If you stop at the headline, you might conclude that frozen treats make people violent or clumsy. The actual cause is heat; both crimes and cone sales rise when the temperature does. The variables move together for a reason neither of them controls, and no amount of staring at the two numbers will reveal it, because the thing doing the work was never one of the two numbers.
We keep making this mistake, and the reason is not that people are bad at statistics. It’s that we prefer the visible story to the invisible mechanism, and the visible story is always available first. It’s easier to believe in a direct link than to hunt for the third variable hiding in plain sight, because a direct link is a complete explanation the moment you state it, while a search for the hidden cause is open-ended work with no guarantee of a payoff. That preference is the single most expensive habit in business, in security, and in markets, and the rest of this is an argument that those three failures are the same failure wearing different clothes.
What the Third Variable Costs
Start with what the preference actually buys you. A surface correlation is not merely incomplete; it is actively misleading, because it tells you where to intervene and it points at the wrong place. If you believe cones cause crime, you regulate cones. Nothing improves, and now you have a policy, a budget, and a constituency defending a measure that never touched the mechanism. The failure is not that the first explanation was wrong. The failure is that it was actionable, and being actionable is what let it survive long enough to consume resources.
This is why the discipline matters more as the stakes rise. In 2026, a wine distributor ran a $97 million loan scheme built on forged documents and fake provenance. The banks he conned weren’t stupid, and that detail is the whole point rather than a caveat. They saw the surface: vintage labels, paper trails, and collateral that looked solid. They didn’t check what was underneath. Fraud doesn’t work by inventing something brilliant. It works by exploiting the gap between appearance and reality, which means the fraudster’s real skill is not forgery but timing. He doesn’t need to fool everyone forever. He only needs the people who sign checks to stop asking questions long enough for the deal to close, and institutions are organized in a way that makes exactly that window reliably available. The damage is done before the first honest inspection happens, and by then the inspection is a postmortem rather than a control.
Proof of Exploit as a Standard
Security has been running the same experiment at industrial scale, which is what makes the shift now underway worth paying attention to. TheNextWeb recently ranked autonomous pentesting tools by proof of exploit, and the ranking criterion is more interesting than the ranking. The security industry has spent years selling assurance as a product: brand names, compliance checklists, and dashboards that glow green. Every one of those is a surface measure. Every one of them correlates with being secure, in roughly the way cone sales correlate with crime, and every one of them can be produced without the underlying property being present at all.
Proof of exploit is the anti-feeling. It asks what can actually be broken, not what the brochure promises, and it has the uncomfortable property of returning a result you cannot negotiate with. A checklist can be satisfied. A dashboard can be configured. An exploit either works or it doesn’t, and when it works there is no version of the story in which you were fine. The market is slowly learning that the only audit that matters is one that finds something, which inverts the incentive that has governed the field for a decade, where a clean report was the product being purchased. The gap between looking secure and being secure is where all the damage gets done, and the gap is wider than most budgets admit, because closing it requires paying for bad news.
For product builders, the same logic applies in miniature. Exit surveys and A/B tests aren’t glamorous work. They’re the humble, evidence-based version of the same discipline, and they do the same thing proof of exploit does: they replace an assumption with a result. A pop-up asking “Is there anything we could have done differently to make you stay?” refuses the comfortable narrative that users left because of some vague dissatisfaction. It goes looking for the actual cause. Most teams skip this step because the real answer is usually something they broke, not something the market did, and a market-shaped explanation has no owner while a bug-shaped one does. They’d rather believe in a fictional user than face a real bug, and the product dies a little more each time they look away, not dramatically, just one unexamined departure at a time.
The Wave and the Ocean
There’s an older formulation of this idea, expressed in how we talk about waves. A wave that mistakes itself for the ocean has the wrong unit of analysis. It makes the self the container, the fixed point, and the whole thing, which is a natural error for anything that can only perceive from where it is standing. The fuller view is that the wave is a gesture the ocean makes. It is not separate from the water that carries it. The shift changes everything: from self as boundary to self as event, and from what I feel to what actually holds me up.
That reframing is the same correction the ice cream study demands, moved from data into experience. In both cases the error is scoping: treating the thing you can observe as the thing that is happening. The wave has access to its own motion and no access to the ocean. The bank had access to the paperwork and no access to the cellar. The security team has access to the dashboard and no access to the exploit. In every one of those, the available evidence is real, and it is also the wrong unit, and being sincere about the evidence you have does nothing to fix that.
How Markets Punish the Surface
Markets are no different, and they are less forgiving than the other domains because the feedback arrives with money attached. Every trader sees patterns. The question is whether they’re looking at the ice cream or the temperature, and the market will not tell you which, because a spurious correlation and a real one look identical right up to the moment the hidden variable moves. The ones who ask about the hidden variable last longer, not because they are right more often, but because they know what would have to be true for them to be wrong. The ones who only count what’s visible end up funding the next vintage scam, wondering how something so good on paper turned out so false underneath.
The edge belongs to the people who refuse to stop at the surface. It always has. What has changed is only that the surfaces have gotten better at looking like the depth.
Leave a Reply