Outside directors can do a bad job, sometimes spectacularly. Yet outside directors of U.S. public companies who fail to meet what we call their "vigilance duties" under corporate, securities, environmental, pension, and other laws almost never face actual out-of-pocket liability for good faith conduct. Their nominal liability is almost entirely eliminated by a combination of indemnification, insurance, procedural rules, and the settlement incentives of plaintiffs, defendants, and insurers. The principal risk of actual liability is under securities law, for an insolvent company (which can neither pay damages itself nor indemnify the director) with one or more seriously rich (hence worth chasing) directors, where damages exceed the D&O insurance policy limits and the director does not represent an institution that can indemnify him. The principal sanction against outside directors is harm to reputation, not direct financial loss. In a companion paper, Bernard Black & Brian Cheffins, Outside Director Liability Across Countries (2003), we study six comparison common-law and civil-law countries (Australia, Britain, Canada, France, Germany, and Japan). We find huge differences in legal rules and nominal liability. Securities and corporate law risk recedes, while nominal liability under other laws becomes central. Yet we find a similar pattern of a tiny but nonzero risk of actual liability. This suggests that a barely open window of actual liability is a stable solution, both politically and in the D&O insurance market. A barely open window may also be a sensible policy solution, given the multiple goals of incenting directors to be optimally (not maximally) diligent, wanting directors to be aware of potential liability for misconduct yet not overly risk averse, and wanting good candidates to become directors. The details of where the liability risk comes from may have only a small effect on director behavior.