Severity is only useful if it changes what happens next. In Hyperping, incidents carry a severity from the project's levels (critical, major, and minor by default), and an incident declared by hand from the dashboard, the API, or the MCP server gets its severity and escalation policy when it's created. Pair each level with its own escalation policy, so a critical incident rings phones and a minor one posts to chat.
A common severity scale
- SEV1, critical: the product is down or a core feature is broken for most users, or data is at risk. Page immediately, update the status page, involve leadership.
- SEV2, major: a core feature is broken for some users, or badly degraded for all. Page the on-call engineer and post on the status page.
- SEV3, minor: a secondary feature is broken, or there's a workaround. Handle during working hours.
- SEV4, low: cosmetic problems or internal tools. A ticket is enough.
Four levels is the usual maximum. With more, people spend the first minutes of an incident debating the level instead of fixing the problem.
How to define your levels
- Describe each level by impact, with examples from your product: "Customers can't log in" is SEV1, "Exports are delayed by more than an hour" is SEV3.
- Attach actions to each level: who is paged, through which channel, whether the status page is updated, and whether a post-mortem is required.
- Let anyone raise the level, and lower it only once the impact is understood. Starting high and stepping down costs less than the reverse.
- Review the levels after major incidents. If SEV2s keep turning out to be SEV1s, the definitions are off.
Severity vs priority
Severity measures impact: how bad is it? Priority measures order: what do we work on first? They usually move together, but not always. A SEV3 bug that will become a SEV1 on Monday, when a large customer goes live, can deserve a higher priority than its severity suggests.
FAQ
What is a SEV1 incident?
The highest severity level: a major outage or a problem affecting most users, revenue, or data. It triggers the full response, with immediate paging, status page updates, and a post-mortem afterwards.
Who decides the severity of an incident?
The first responder sets it, based on the written definitions. The incident lead can change it as the impact becomes clear.
Should every incident get a post-mortem?
Every SEV1 and SEV2, at minimum. For lower levels, write one when the incident taught you something or keeps recurring.