Everything works and nobody came
The most expensive failure is the one that does not report itself. A story about ourselves.
In August a portal stood ready. Notifications worked, the gate worked, the publishing integration worked, and it had been tested against both a healthy and a broken customer page. Two people had been invited.
When we looked in the database a week later: two invitations, both still open, zero sessions. Nobody had been inside.
Why you do not notice
Nothing broke. That is the whole problem. Monitoring watches for faults: failing requests, slow responses, a service that stops answering. A tool nobody logs into produces no errors at all, because nothing is being asked of it that could go wrong.
If anything, the better it is built, the quieter it is. Everything sits there running, neatly, endlessly, and the costs keep going.
Why people do not come in
Not because they do not want to. That is the mistake you make when you have spent two weeks building it yourself.
The email arrived on a busy morning. The link asks you to choose a password, and that is one step more than there was time for. It is not obvious what is behind that door, so it feels like a chore rather than something that pays off. And the link expires after a week, so anyone who puts it off cannot get in at all afterwards.
None of those four is a technical problem. All four cost exactly as much as an outage.
What we changed
A notification every morning while nobody has been in. Not once — every day, until the first login. A reminder that comes once is a reminder you miss on a busy morning.
The first login goes into the log. Not because it is interesting in itself, but because it is the one event the rest of the story starts from. Everything we build comes after it.
The invitation’s expiry is watched. If a link runs out before it is used, that is something we should see, not something the customer walks into.
The general lesson
“Does it work” and “is it being used” are two questions, and we answer the first by default and the second by default not at all. For any tool you have built, with us or with anyone else, this is the question to ask: how will I know someone actually used it, and how quickly will I know?
If the answer is that you will have to go and ask around at some point, you will not do it, and you will find out in the quarterly review.
Frequently asked questions
Why not just pick up the phone?
That is exactly the right response, and it works better than anything else. The point is that you only call once you know nobody has been in, and nobody knew. The notification does not solve the calling, it solves the knowing.
Do you measure what users do?
No, and that is deliberate. The log holds acts with consequences: a piece arriving, being approved, being published, and the first time someone takes their account into use. Looking is not recorded; that fills up with noise and it is a file on a customer's behaviour that is none of our business.
What if an invitation has expired?
Then we issue a new one. It costs nothing and nothing is lost; the invitation itself stands, only the link is new.
How do I prevent this with a tool of my own?
Agree before delivery which first action counts as "it is in use", and make sure someone is told when that action fails to happen. Measuring uptime is easy and says nothing here; this failure lives in the silence rather than in the error log.