The incident process timeline

```meta
title: The incident process
subtitle: Five phases, one target for Q4 — cut time-to-mitigate in half.
tag: DECK OPENER · Q4 2026
```

## Assumptions

```callout
tone: note
title: Assumptions
body: "The process is the five-phase lifecycle the platform team runs today: Detect, Triage, Mitigate, Resolve, Review. The quarter is Q4 2026. The phase under improvement is Mitigate, chosen because it holds the largest share of customer-facing minutes in the last two quarters. Durations are medians over Sev1 and Sev2 incidents from April to September 2026, taken from the on-call tracker."
```

## Five phases carry every incident from alert to lesson

Every Sev1 and Sev2 runs the same five phases in the same order. Ownership changes at each boundary: the on-call engineer owns Detect and Triage, the incident commander owns Mitigate, the service team owns Resolve and Review. The customer is affected from the first alert until Mitigate ends.

```chevrons
id: phases
title: Incident lifecycle
current: 3
steps:
  - { label: Detect, desc: "alert fires, on-call paged", accent: navy }
  - { label: Triage, desc: "severity set, commander named", accent: navy }
  - { label: Mitigate, desc: "customer impact stopped", accent: amber }
  - { label: Resolve, desc: "root cause fixed and deployed", accent: navy }
  - { label: Review, desc: "postmortem published in 5 days", accent: navy }
```

## Mitigate holds most of the customer-facing minutes {split}

Customers feel an incident from Detect through Mitigate. Of the median 97 minutes in that window, 68 sit in Mitigate. Detect and Triage together take 29.

Resolve and Review are longer, but the customer no longer sees them. The largest cut to customer-facing time comes from the phase with the most minutes.

```chart
title: Median minutes per phase, Sev1 and Sev2, Apr–Sep 2026
kind: bar
unit: min
labels: [Detect, Triage, Mitigate, Resolve, Review]
series:
  - { label: Median minutes, accent: navy, values: [11, 18, 68, 190, 4320] }
```

## The Q4 target is a 34-minute Mitigate {split}

The two known causes are a runbook that exists for 41% of paged services and a rollback that needs a manual approval outside business hours. Q4 closes both: a runbook per paged service, and self-serve rollback for the commander.

```bignumber
value: "34 min"
label: Median time in Mitigate by end of Q4
context: "Down from 68 min. Measured on Sev1 and Sev2 incidents from October to December 2026."
delta: "-34 min"
trend: down
accent: amber
```

## What to remember

```takeaways
title: Takeaways
items:
  - text: Five phases, unchanged
    detail: "Detect, Triage, Mitigate, Resolve, Review. The order and the owners stay as they are."
  - text: Q4 improves Mitigate only
    detail: "It holds 68 of the 97 customer-facing minutes."
  - text: The target is 34 minutes
    detail: "A runbook for every paged service and self-serve rollback for the commander."
```