Incident Severity and Triage

Once you realize you have a problem, ideally through an alert (less ideally through a news headline), you need to triage it.

You gotta figure out how bad it is quickly enough to respond proportionally. Not every anomaly is an incident, and not every incident is "critical."

Most organizations use 3–5 severity levels. The exact labels don't matter too much. Some companies use colors (yellow, orange, red), some use severity numbers (sev3, sev2, sev1), and some use descriptive labels (medium, high, critical). The important thing is that everyone understands what each level means and how to respond.

When something looks wrong, ask three questions:

1. What's the blast radius? How many users are affected? Is it one person, one org, or everyone?
2. What's the impact on those affected? Is the system just slow? Or has sensitive user data been exposed?
3. Is it active? Is the attack happening right now, or is this a vulnerability that could be exploited, or is it a past incident that has already been contained?

Those answers determine severity.

Incident Ownership

It's best practice to assign a single person (dramatically dubbed the incident commander by people who have too much time on their hands) when an incident is discovered. That person doesn't need to be the hero who fixes the problem, but they do need to coordinate the response, keep communication flowing, and make sure it gets resolved.

Without an owner, multiple people investigate the same thing, nobody updates stakeholders, and fixes get delayed because everyone assumes someone else is handling it.