Culture
Reading attestation fatigue before controls fail
DevCloud Masters insights
Attestations feel cheap until they are the only signal you have. Fatigue shows up before the control fails: sign-offs pile up on Friday nights, free-text fields shrink to “confirmed,” and reminders get muted.
Signals worth logging
Track median hours from request to completion, percentage of identical comment strings, and how often backups sign instead of primary owners. None of these prove a breach — they prove the monitoring channel is wearing out.
Response without theatre
Reduce frequency on low-risk attestations, rotate sampling into independent evidence for high-risk ones, and tell owners why a particular confirmation still matters. Vague pep talks do not reverse fatigue; narrower, sharper asks sometimes do.