An Algorithm With No Brakes
Here's the uncomfortable truth about automation: it doesn't just do the right thing quickly — it does the wrong thing just as quickly. A human trader who makes a mistake pauses, frowns, and second-guesses. A program that makes a mistake repeats it thousands of times a second without a flicker of doubt. So risk management isn't a polish step you add once the strategy works. It's the thing standing between a small bug and a burned-down account.
Think of it like the brakes on a car. Nobody buys a car for its brakes — but nobody sane drives one without them, because the whole point of going fast is being able to stop. An algorithm with no brakes will happily lose everything at machine speed, doing exactly what you told it to do, perfectly, all the way down. Every guardrail in this lesson is a different kind of brake.
Speed cuts both ways
The same automation that places a good trade in a millisecond places a broken one just as fast — and then again, and again. Without a guardrail to stop it, there's no natural pause where a human would notice and step in. That absence of a pause is the core danger of automated trading, and it's why the controls below exist.
The Four Guardrails
Risk management in an automated system is really a small set of controls, each answering a different "how bad can this get?" question. They're worth naming clearly, because a serious system layers all four rather than trusting any single one.
The first is position sizing — never letting one trade be large enough to be fatal on its own. If a single position can wipe out the account when it goes wrong, nothing else matters, because you may not get a second chance. This is also where leverage earns its scary reputation: borrowing to trade bigger magnifies both the gain and the loss, so it quietly turns a survivable mistake into a fatal one. Small size is the most basic brake there is.
The second is the per-trade limit — a stop-loss or a maximum loss any single trade is allowed to reach before it's closed. It draws a line under how much one idea can cost you. The third works one level up: portfolio limits. These cap the whole system rather than a single trade — a maximum drawdown (how far the account can fall from its peak) that halts trading when breached, ceilings on total exposure, and diversification across different ideas so one bad theme doesn't sink everything at once.
The fourth is the kill switch — the big red button. It's an automatic or human trigger that blocks new orders and usually cancels the open ones the moment things look wrong, stopping the system from trading. Reducing or liquidating positions it already holds is a separate, deliberate step — dumping everything at once can create its own market impact, so it isn't the switch's default job. Everything else limits how much a normal loss can hurt; the kill switch exists for the abnormal day, when the system is doing something nobody intended and the only safe move is to make it stop entirely.
The One-Sentence Version
Four brakes, four questions: position sizing (can one trade kill me?), the per-trade limit (how much can this idea cost?), portfolio limits (how far can the whole account fall?), and the kill switch (how do I stop everything right now?).
How Automated Systems Actually Break
Automated systems don't fail the way a human does. There's no panic or fatigue — instead there's a code bug that does something subtly wrong on every run, a good strategy fed bad or stale data so its perfect logic acts on numbers that no longer describe reality, or an overfitting strategy that memorized the past and quietly stopped working the moment the future looked different. Add runaway loops that fire duplicate orders, and infrastructure failures — a network drop mid-order that leaves the system unsure whether a trade even happened.
The common thread runs through all of them: the machine can't tell it's malfunctioning. It has no sense that today is weird. It just keeps executing. That's why each failure below is paired with the specific guardrail whose whole job is to catch it — the machine won't notice, so something around it has to:
| Failure mode | What can go wrong | Guardrail that catches it |
|---|---|---|
| Oversized position | One trade grows big enough to sink the whole account | Position sizing + a maximum exposure cap |
| Strategy stops working | An overfit or stale idea keeps trading long after its edge is gone | Drawdown limit that halts the system as losses mount |
| Code bug / runaway loop | A logic error fires the same order again and again | Max orders per minute + a kill switch |
| Bad or stale data | Good logic acts on prices that no longer reflect reality | Data sanity checks that pause trading on absurd inputs |
| Infrastructure / network failure | A dropped connection mid-order leaves position and record disagreeing | Reconciliation against the broker + human monitoring |
Each failure mode has a matching brake. Notice none of them rely on the algorithm noticing its own mistake — every guardrail sits outside the strategy on purpose.
Look down that last column and one thing stands out: every brake lives outside the strategy that's failing. You never ask the buggy code to police itself, because a bug can't see its own bug. Guardrails are deliberately separate — a second set of eyes, whether automated or human, watching the first.
Two Crashes That Explain the Brakes
None of this is theoretical, and two well-known historical incidents show why these controls exist. They're factual teaching examples — history, not predictions about anything ahead.
In August 2012, the trading firm Knight Capital deployed a faulty software update. A piece of old code woke up by mistake and began sending a flood of unintended orders into the market. In roughly 45 minutes, the firm lost around $440 million — a self-inflicted wound large enough that it nearly destroyed a major company in less time than a lunch break. A working kill switch and tighter order limits are precisely the brakes that could have shortened those 45 minutes to seconds.
Earlier, on May 6, 2010, the market suffered the so-called "Flash Crash." A wave of automated selling helped briefly erase something on the order of $1 trillion in market value, with some stocks momentarily trading at absurd prices — before the market rebounded much of the way within minutes. It was a vivid lesson in how fast automated systems interacting at speed can spiral, and it pushed the industry toward single-stock circuit breakers and the limit-up/limit-down mechanism, which pause trading in an individual stock when its price moves too violently, too fast.
Keep the facts modest
Both figures above are widely reported approximations of complex events with many contributing causes, not tidy one-line morals. The point isn't the exact dollar amount — it's the shape: automation let a mistake grow enormous, enormously fast, and the response afterward was more and better brakes.
A Worked Example: Inside a Misfire, Second by Second
Instead of listing the brakes again, let's run the clock. Every timestamp and number below is illustrative only — a stylized incident, not a real event. Picture a strategy that's meant to buy 100 shares of a stock, once, when its price data says the moment is right. Then a data feed quietly freezes and a loop bug wakes up. Walk the seconds that follow one by one, and watch a different guardrail catch the same failure at each depth:
09:31:00 — the feed freezes
A market-data feed stops updating and its last quote sticks in place. The strategy has no idea: it keeps evaluating its rules against a price that no longer describes reality. Nothing has visibly gone wrong yet — which is exactly why the machine can't tell it's already in trouble.
09:31:02 — the stale-data check trips
A data sanity check is quietly comparing the feed's timestamp to the wall clock. Two seconds with no fresh tick crosses its threshold, so it flags the feed as stale and pauses trading on that symbol. Ideally the story ends right here. But suppose the freeze is intermittent — one late tick sneaks through, the check un-pauses, and the failure slips past the first brake.
09:31:03 — the misfire begins
Acting on the frozen price, the strategy reads what looks like free money and fires its "buy 100 shares" order. A coding mistake has wrapped that order in a loop with no exit, so it re-sends the same order over and over — hundreds of times a minute. Left alone, it would keep buying until the money ran out.
09:31:04 — the order-rate limit throttles it
A rule caps the system at no more than, say, 10 orders per minute. The eleventh order in the minute is blocked outright, so the flood drops to a trickle. That throttle buys the most valuable thing in an incident: time — enough for an alert to reach a human as rejected orders pile up.
09:31:05 — the position cap contains it
A separate rule says this stock's position may never exceed, say, 500 shares. The handful of orders that did get through have carried the position to that ceiling, so every further buy is rejected. The loop is still running, but it can no longer add risk — the loss is contained at 500 shares instead of draining the whole account.
09:31:06 — reconciliation flags a mismatch
Amid the storm, one broker acknowledgement was dropped on the network. Reconciliation compares the system's own record of what it holds against the broker's record and finds the two disagreeing. It raises a flag so nobody trusts a position number that is now quietly wrong.
09:31:08 — the kill switch stops everything
A monitor has seen enough: an impossible burst of identical orders means the system is clearly malfunctioning. The kill switch blocks new orders and cancels the open ones, halting all trading. Reducing or liquidating the 500-share position already built up is a separate, deliberate step — dumping it all at once could move the market against you. Nobody understands the bug yet, and it doesn't matter: the machine is stopped before it can finish its work.
The same misfire, met by five brakes stacked one behind the next: a stale-data check, an order-rate limit, a position cap, reconciliation, and the kill switch. That's the whole philosophy of layered risk management — you never trust one brake to always work, so you stack several, each ready to catch what the one before it missed. A single guardrail can fail; five failing at once is far less likely.
Sources & Further Reading
- SEC Charges Knight Capital With Violations of the Market Access Rule (2013) — U.S. Securities and Exchange Commission
- Findings Regarding the Market Events of May 6, 2010 (the "Flash Crash") — Joint CFTC-SEC staff report
- Equity Kill Switch — Nasdaq (a kill switch disables order-entry ports and cancels open orders)
Educational use only
Educational content only. StockCram isn't a broker or adviser, and we have no affiliation with any institution or tool we mention. Nothing here is a recommendation to trade in any particular way.