Post-incident review

Incidents will happen: a pumping wave, a SIM-swap takeover, a delivery outage in a key market. The review afterwards decides whether the same thing happens again. Run it blameless, run it within a week, and end it with owned, dated actions.

A template

• Summary — two sentences a non-engineer understands.
• Impact — users affected, money lost, duration, markets.
• Timeline — first signal, detection, response, resolution, with timestamps.
• Detection — which alert fired, or why none did.
• Contributing factors — technical, process, and vendor.
• What went well — so you keep doing it.
• Actions — each with an owner and a date.

Questions that find the real gaps

• How long between the first anomalous send and the first human looking at it?
• Which control was supposed to stop this, and why didn't it?
• Could the kill switch have been used earlier? Did the on-call engineer know it existed?
• For takeovers: which ceremony was used, and was the action correctly classified as high-risk?