The Normalization Trap: Designing Wargames That Detect When Players Stop Seeing Warning Signs

Diane Vaughan's autopsy of the Challenger disaster gave us the term 'normalization of deviance': the process by which organizations gradually redefine acceptable risk until the catastrophic becomes routine. What makes it a design problem for wargames is that the condition is self-concealing. Players who have normalized a warning sign will not report it as normalized. They will report it as resolved.

Photo by Matias Luge on Pexels.

Most wargames are built to detect action failures. Did the player read the intelligence? Did they escalate at the right threshold? Did they coordinate? Those are the right questions, but they miss the earlier failure: the player who never escalated because the warning had already been reclassified as background noise before the game began.

Building a wargame that catches this requires some deliberate mechanical friction.

Seed the Signal Before the Scenario Starts

The core technique is pre-game contamination. Before the formal scenario kicks off, give players a short pre-read briefing that contains three or four minor anomalies buried in routine operational data. These anomalies should map to the catastrophic event you are stress-testing. They should look explicable individually: a sensor calibration drift, a contractor reporting delay, a maintenance log with a small gap.

Design them so a reasonable analyst would explain each one away. Then run the scenario.

When the catastrophic signal appears during the game, watch whether players connect it to the pre-read anomalies. In most runs, they will not. The pre-read briefing has done its work: it has normalized the signal before the players ever saw it in a high-stakes context.

The design goal is not to trick players. It is to show them, in the debrief, exactly when and how they stopped seeing.

The Accumulation Counter

One useful mechanic is what I call an accumulation counter, kept by the game controller and invisible to players. Every time a player character explains away an anomaly (verbally or in a decision log), the controller increments the counter. The counter is never revealed during play.

At the debrief, you read the count aloud before showing the timeline. Twelve explanations. Seventeen. The number lands differently than a narrative critique would. Players can argue with an interpretation; they have a harder time arguing with a record of their own words.

Pair the counter with a simple flowchart shown only post-game:

graph TD
    A[Anomaly presented] --> B{Player explains it away?}
    B -- Yes --> C(Counter increments)
    B -- No --> D(Flag for escalation review)
    C --> E{Same anomaly type recurs?}
    E -- Yes --> F(Normalization confirmed)
    E -- No --> G(Isolated rationalization)
    D --> H[Escalation pathway active]

Showing players this flowchart before the game would defeat the purpose. Showing it after gives them a model for what happened to them.

Vary the Explainability of Each Signal

Not all anomalies should be equally easy to rationalize. Design a gradient. Some signals should be nearly impossible to explain away on their own; others should be trivially dismissible. The dangerous design is a set of signals that are all individually plausible to ignore, because that set will get ignored every time.

The gradient forces differentiation. Players who catch the hard-to-explain signal but miss the easy ones reveal something about their threat model: they are watching for one kind of failure and blind to another. Players who miss the hard signal entirely have normalized further than you thought.

Historically, this gradient appeared in the pre-9/11 intelligence environment. The August 6, 2001 President's Daily Brief title ('Bin Laden Determined to Strike in US') was not subtle. What had been normalized were the dozens of lower-grade reports that preceded it, each individually deniable, which trained the organizational expectation that warnings at that level meant nothing was imminent. The hard signal arrived inside a context the softer signals had already corrupted.

The Re-Briefing Injection

A second mechanic: midway through the scenario, have the controller issue a re-briefing that corrects one of the pre-read anomalies. The sensor calibration drift, it turns out, was a real failure, not a calibration artifact. The maintenance log gap was a reporting error that concealed two missed inspections.

Watch whether players update. Many will not, because the normalization has set. They have already filed the anomaly under 'resolved' in their mental model. The correction arrives in a cognitive space that has been closed.

This is speculative as a universal claim, but consistent with findings from exercises run by the Johns Hopkins Center for Health Security in their pandemic tabletops (2017-2019): correction of prior normalized signals mid-exercise rarely produced the recalibration that the same correction would have produced at the start.

What You Are Actually Measuring

The normalization trap is not about whether players are smart or attentive. Several of the best analysts I have seen run through these exercises had the highest accumulation counts. The trap catches expertise as readily as inexperience, because expertise generates better explanations.

What the mechanic surfaces is organizational time: how long a system has been looking at a class of signal before the catastrophe. The longer the exposure, the higher the normalization risk. Your wargame should simulate that exposure explicitly, not assume players arrive at the scenario with fresh eyes.

They never do.