Learn it → Apply it → Save as Skill
No single safeguard is perfect. Serious harm happens when the weak points in several independent layers of defense line up at the same moment and a hazard travels straight through the whole stack.
The Dr. Wallace’s Favorite Mental Models is designed to turn useful ways of thinking into reusable tools. Each model gives you a fast visual overview, deeper interactive learning, practical application exercises and an AI-ready Markdown skill you can save for future use.
Instead of merely reading about mental models, you can gradually build your own AI skills library: a collection of portable reasoning skills that can help ChatGPT, Claude, Grok and other AI assistants apply the mental models you value.
Picture each safeguard, design, training, procedure, supervision, inspection, as a slice of cheese with holes representing its weak points. A single slice usually stops a problem on its own. Harm gets through only when the holes in several slices happen to line up at once.
Important: real holes are not fixed in place. Staffing, workload and conditions shift them constantly. This is a snapshot of one bad moment, not a permanent diagram.
The model is most useful whenever several safeguards already exist between an error and its consequences, and you want to understand why they occasionally all fail together.
The method walks from naming defenses to testing whether they would actually hold up together, not only individually.
List every layer of defense currently standing between the hazard and serious harm.
Identify the realistic weak point in each layer, not the layer’s intended, ideal design.
Test whether the layers are genuinely independent or secretly share the same root weakness.
Fix a specific hole or add a layer with a different weak point, then re-examine the whole stack.
Open a use case to see what the model changes.
Instead of stopping at the person closest to the harm, map every layer that was supposed to catch the problem and find the specific weakness in each one. Look for where the layers secretly shared a cause.
Separate the frontline slip from the latent conditions, staffing, software defaults, unclear handoffs, that let it travel through. Fix the earliest layer with a genuine hole rather than only retraining the last person who touched it.
Check whether firewall, authentication, monitoring and response controls are truly independent defense-in-depth layers, or whether one shared credential or misconfiguration undermined several of them at once.
Name the habits, reminders and checks you normally rely on, then see which ones were missing or weak at the same time. Add a safeguard that fails differently than the ones you already have.
Map code review, automated tests, staging checks and monitoring as separate layers. If the same blind spot exists in all of them, for example no one tests a rare input, adding a fifth similar layer will not help much.
Use near-miss reports to find which layers almost failed together. A near miss is evidence that the holes came close to aligning, and it is cheaper to fix before they actually do.
This is an illustrative example designed to teach the method.
Expand for the distinction between what James Reason actually proposed and how the metaphor is used today.
British psychologist James Reason introduced the model in his 1990 book “Human Error” and developed it further in his later work on organizational accidents. He used it to explain how accidents in complex systems, such as aviation and nuclear power, come from a combination of weaknesses rather than one single cause.
Reason distinguished active failures, the unsafe acts committed by people in direct contact with the system such as a slip or a missed step, from latent conditions: longstanding weaknesses built into the system itself, including design flaws, understaffing, unclear procedures, or poor tools. Latent conditions can sit undetected for years before combining with an active failure to cause harm.
Reason himself cautioned that the diagram is a simplification. The slices and their holes are not fixed; they open, close and shift position as staffing, workload, training and conditions change. Treat the image as a way of reasoning about layered, independent defenses, not as a literal engineering model.
Blaming only the person closest to the harm skips the latent conditions that made their slip likely or even inevitable.
A second checklist reviewed by the same rushed team does not add independent protection.
Extra layers add cost, friction and false confidence if they are not genuinely independent of the ones already in place.
Staffing changes, new software, fatigue and workload constantly reposition the weak points. Review the stack regularly, not once.
The same mapping works before an incident, using near misses as evidence of how close the holes came to aligning.
In very tightly coupled systems, one failure can cascade faster than any layer can catch it. Layering helps less there.
the system is so complex and tightly coupled that interactions between failures happen faster than any layer can intervene.
you need to trace one dominant cause rather than model several independent contributing layers.
a person violated a clear rule in a way no reasonable system design could have prevented.
This browser tool structures your thinking. It does not send your information anywhere or perform AI analysis.
Save as Skill converts the model into portable Markdown instructions that teach an AI when and how to apply the Swiss Cheese Model, what questions to ask, what evidence to seek, what mistakes to avoid and how to structure its analysis.
Save the skills you find useful and organize them into your own reusable library. The Markdown is intentionally model-neutral, so it can be used wherever an AI system accepts uploaded files, project knowledge, custom instructions or reusable text context. Platform capabilities differ, so this is a portable skill file rather than a claim of one-click installation.
No. It says harm usually requires more than one failure. Individual judgment still matters, but the model asks what system conditions made a slip more likely and why no other layer caught it.
There is no fixed number. More layers help only if each one has a different weak point than the others, and the added cost and friction are worth the risk reduced. A single, very reliable layer can outperform several weak, correlated ones.
Defense in depth is the same underlying idea applied in security and engineering: layer independent controls so that no single point of failure is catastrophic. The Swiss Cheese Model is the accident-analysis framing of that same principle.