Which paths have no barrier?
Prevention on the left, mitigation on the right. A register says you have twelve controls; a bow-tie shows that all twelve sit on one of the four paths.
Threats, the event, and what follows
Prevention on the left, mitigation on the right. The value is seeing which paths have no barrier on them at all.
Threats — what could cause it
List preventive controls after a pipe, separated by semicolons. Add ! to mark one as weak: Phishing | MFA; Training!
Consequences — what follows if it happens
The bow-tie
Gaps and weaknesses
What is checked
- A threat with no preventive control — an open path to the event. Reported as an error.
- A consequence with no mitigating control — an open path from it. Also an error.
- A path guarded only by weak controls — a warning. One weak barrier is close to none.
- A control appearing on several paths — a warning. It looks like defence in depth on the diagram and is a single point of failure in practice.
No probabilities are calculated. A bow-tie is a structural picture of barriers, and attaching numbers to it implies a quantification the diagram does not support.
Two different jobs, one diagram
The left side stops the event happening. The right side limits the damage once it has. They are genuinely different work and a barrier on one side does nothing whatever for the other.
Teams reliably over-invest in prevention and under-invest in mitigation, because prevention feels like solving the problem and mitigation feels like admitting it will happen. Drawing both sides makes the imbalance visible: a diagram with six preventive controls and one mitigating control is telling you something about how the organisation thinks.
The gaps are the output
A threat with nothing between it and the event is the finding. It is obvious on a drawn bow-tie and nearly invisible in a risk register, where controls are listed against the risk as a whole rather than against the specific path they block.
That difference is the entire reason to draw the diagram. "We have twelve controls for this risk" sounds reassuring right up until you notice that all twelve sit on one of the four paths.
Common-mode failure wears a disguise
When one control appears on several paths, the diagram looks well defended and is not. If that control fails, every barrier depending on it fails at the same moment.
Monitoring is the usual culprit — it appears against every threat because it genuinely helps with all of them, which means an outage of the monitoring removes the whole left side at once. Worth knowing before it happens rather than during.
No numbers, on purpose
Bow-ties invite quantification and resist it. Assigning each barrier a failure probability and multiplying along the path produces a figure that looks like a risk estimate and is built on judgements that were never that precise.
The diagram is a structural tool. Use it to find missing barriers and shared dependencies, and use something else when you need a number.