The dependency nobody was watching.
DORA's Art. 10 (detection) is the article about noticing what is wrong with an ICT system, before it fails and while it is failing: mechanisms to promptly detect anomalous activity, ICT network performance issues, and incidents already underway, and, separately, to identify potential material single points of failure in the systems behind a critical function. It also expects those mechanisms to work through layered controls, to be resourced adequately, and to reach the people who would actually respond, not just log the event somewhere. Much of that detection layer is built in code and infrastructure for a financial entity: the health checks, synthetic monitors, and alert routing watching a critical function and the dependencies it cannot do without.
The shapes the same control failure takes.
Detection erodes when a change removes or blinds a way the system would notice a problem, thins it down to a single layer, or breaks the path from an alert to the person who would act on it. The recurring shapes:
A single point of failure goes unreviewed
A dependency has quietly become the only path a critical function has, every environment now points at one provider or one instance. Nothing in the change (an inventory, a review, a check) surfaces that concentration, so nobody notices the resilience already rests on one thing.
Detection is removed from a third-party dependency
A synthetic check or health probe watching a critical external provider's availability or latency is deleted, so a degrading dependency stays invisible until it fails outright.
Detection thins to a single layer
A critical function's health had more than one way to be noticed, a metric, a check, an operational review, and a change removes one of them, leaving a single signal as the only thing standing between a real problem and nobody knowing.
An alert stops reaching the people who would act on it
Paging to the on-call incident responder is downgraded to a channel nobody actively watches, so the detection exists on paper without reaching anyone who would start the response.
A performance threshold is set past what the function can absorb
A latency or error-rate threshold is loosened so far that a real degradation in a critical ICT chain no longer trips it, leaving the check present but ineffective.
A synthetic check on the payment processor, removed.
A synthetic monitor pings the payment processor's health endpoint every minute, the earliest available signal for that dependency, and pages on-call if latency crosses a threshold. It has been firing during the processor's own maintenance windows, so a change removes it. The noise stops, and now a slow or failing processor, the single external dependency the whole payment flow relies on, can degrade with nobody paged until customers report failed payments.
-resource "datadog_synthetics_test" "payment_processor_health" {- request { url = "https://status.card-processor.example/health" }- assertion { type = "response_time", operator = "lessThan", target = 800 }- alert_ids = [datadog_monitor.oncall_pager.id]-}Removing the synthetic check takes away the earliest warning that the payment processor is degrading, and the payment flow has no second processor to fall back on, so this dependency is also a candidate material single point of failure, something Art. 10 expects a financial entity to identify separately from day-to-day detection. If the check fires during the processor's own maintenance windows, exclude those windows or tune the assertion; do not remove the only detection layer on a dependency the critical function has no alternative to.
Detection is checked as a working mechanism, not a claim.
Supervision under DORA looks for detection that actually works: does it cover the critical functions and the dependencies they rely on, does it run through layered controls rather than a single signal, are sufficient resources and capabilities assigned to monitoring it, and does an alert reach someone who can act on it. A change that removed a health check on a critical dependency, thinned detection to a single layer, or downgraded paging to a channel nobody watches is the concrete gap behind that, and it is visible in the diff to the monitoring or infrastructure config.
A review, not your synthetic monitoring.
heygrc flags changes that touch a DORA detection obligation and cites the article so the fix happens in the pull request. It does not run your synthetic checks or your paging. It catches the moment a change removes or blinds a way the system would notice a problem with a critical function or a dependency it cannot do without, at the diff.