The Hidden Value of Lower Severity Incidents

As the CEO of FireHydrant, I've observed a peculiar pattern in how organizations approach incident management. When most people think about incidents, their minds immediately jump to SEV1s and SEV2s - those high-stakes, all-hands-on-deck situations where revenue is impacted and executives are breathing down your neck.

But here's the thing: this mindset is holding us back from building truly resilient organizations.

The Marathon Runner's Paradox

Think about training for a marathon. Would you expect someone to successfully complete a 26.2-mile race without ever running a 5K? Of course not. Yet, this is exactly what we're doing when we only focus on high-severity incidents.

By ignoring SEV3s, SEV4s, and SEV5s, we're missing out on crucial "training runs" that prepare our teams for bigger challenges. These lower-severity incidents are our practice sessions, our dress rehearsals for the main event.

Breaking Down the Severity Spectrum

Let's be clear: if you're experiencing SEV1 incidents on a weekly basis, something is fundamentally wrong with your system or processes. These high-severity incidents should be rare occurrences, not regular events.

The real opportunity lies in the lower-severity spectrum:

• SEV3s: Minor customer impact, limited scope

• SEV4s: Internal issues with workarounds available

• SEV5s: Low-urgency problems that need attention

These are your perfect practice grounds.

The Case for Declaring More Incidents

"But won't declaring more incidents create unnecessary overhead?"

I hear this concern often, but it misses the point. When a small functionality breaks due to a bad code deploy, that's not just a hiccup - it's an opportunity. By treating it as a proper incident, even if it's a SEV4 or SEV5, you're:

1. Building muscle memory in your incident response

2. Testing your communication channels

3. Identifying process improvements in a low-stakes environment

4. Giving newer team members hands-on experience

Changing the Cultural Mindset

There's often a stigma around declaring incidents, as if it's an admission of failure. We need to flip this narrative. Every declared incident, regardless of severity, is an investment in your team's capabilities.

Think of it this way: you're already dealing with these issues. The only difference is whether you're handling them in an ad-hoc manner or using them as structured learning opportunities.

Moving Forward

Here's my challenge to engineering leaders: for the next month, encourage your teams to declare more lower-severity incidents. Run the full process. Document everything. You'll likely discover that:

• Response times improve across all severity levels

• Team confidence increases

• Communication becomes more efficient

• Patterns emerge that help prevent future incidents

Remember, the goal isn't to create more work - it's to formalize the learning opportunities that are already present in your day-to-day operations.

Conclusion

The path to incident management mastery isn't paved with SEV1s and SEV2s alone. It's built on the foundation of countless lower-severity incidents that help teams develop the skills, confidence, and muscle memory needed to handle any situation that comes their way.

Stop waiting for the big incidents to practice your response. Start treating every issue as an opportunity to improve, and watch as your team transforms into a well-oiled incident management machine.