The EU bought incident response capacity for its member states and then audited what happened to it: 84 % of the money went to preparation, and 89 % of the response days were never used. Why that outcome is structural.