Finding the paths with no barrier
A register says you have twelve controls. A bow-tie shows that all twelve sit on one of the four paths.
Two jobs, one diagram
The left side stops the event happening. The right side limits the damage once it has. They are different work, and a barrier on one side does nothing at all for the other.
Organisations reliably over-invest in prevention and under-invest in mitigation, because prevention feels like solving the problem and mitigation feels like conceding it will happen. Drawing both sides makes the imbalance visible — six preventive controls and one mitigating control tells you something about how a team thinks.
What a register hides
Risk registers list controls against the risk as a whole. That reads reassuringly and obscures the structure: which specific path does each control actually block?
A bow-tie forces controls onto specific paths, and the gaps become obvious. A threat with nothing between it and the event is the finding, and it is nearly invisible in a register.
Shared controls are a trap
When one control appears on several paths, the diagram looks well defended and is not. If that control fails, every barrier depending on it fails at the same moment.
Monitoring is the usual culprit — it appears against every threat because it genuinely helps with all of them, which means losing it removes the entire left side at once. That is a common-mode failure wearing the appearance of defence in depth, and it is much better understood in advance.
Weak barriers are close to no barriers
A path guarded only by controls everyone privately considers weak is not meaningfully guarded. Recording effectiveness alongside each control is what turns a diagram of intentions into a diagram of the actual situation.
Resist the urge to quantify
Bow-ties invite numbers and resist them. Assigning each barrier a failure probability and multiplying along the path produces something that looks like a risk estimate and rests on judgements that were never that precise.
The diagram is a structural tool. Use it to find missing barriers and shared dependencies; use something else when you need a number.