“If an organization is not able to change its model of itself unless and until completely clear-cut evidence accumulates, that organization will tend to learn late, that is, it will revise its model of vulnerabilities only after serious events occur.”