Incident Management
Practical
By Samson Tanimawo, PhD
Published Apr 16, 2026
4 min read
Frequency vs Severity: Reading the Incident Mix
Counting incidents misses the picture. The mix matters more than the total.
Live workflow · 3 working · 1 queuedLive
Signal · gather Working
Decide · pick action Working
Apply · with verify Working
Learn · update playbook Queued
The mix
Many sev-3s and zero sev-1s = healthy. Lots of small things.
Few sev-3s and many sev-1s = unhealthy. Big things hide.
Read it
Quarterly: histogram of severity counts.
Watch for shifts. Fewer total incidents but higher severity = different problem.
Act
More small incidents: tune alerts; classification too sensitive.
More large incidents: systemic fragility; needs investment.