two is one, one is none
expressionops culturenetworking
The redundancy proverb: with two you can lose one; with one, a single failure leaves you with nothing.
Military in origin and native to network design: dual power feeds, dual supervisors, HA pairs, two of everything on the critical path. The corollary every operator learns: untested redundancy counts as one.
Two is one and one is none is a military maxim about equipment redundancy, adopted into infrastructure because the arithmetic is identical. A single component has no margin: when it fails, the capability is gone. Two components means one can fail and the capability survives, which is the only configuration that tolerates the thing you know will eventually happen.
The way it fails in practice is through hidden commonality. Two power supplies fed from the same circuit are one power supply. Two servers in the same rack, two links through the same conduit, two availability zones with a shared control plane, two administrators who both learned the system from the same person: each pair looks redundant and shares a failure mode. Finding those requires asking what both copies depend on, which is a different question from counting them.
The other half is that untested redundancy is decorative. A secondary that has never carried load, a failover that has never been exercised, a spare that has never been powered on: each is assumed rather than known to work, and the assumption is tested for the first time during the incident. Redundancy that has not been exercised is closer to one than to two.