Incident Crashes, Culture and Cocktails (Incident Fest)

Sam Salter
|
September 1, 2026
Tags:
Best Practices
Blog
Incident Management
Outages
IN THIS ARTICLE

Ready to make incident response your competitive advantage?

See how Uptime Labs builds provable, scalable incident response capability across your organisation.

During Incident Fest 2026, Beth Adele Long and John Allspaw (Adaptive Capacity Labs), hosted a Q&A. Here are a few highlights, focused on a miscellany of incident response topics.

On oversaturating the bridge

Q: Is there a limit on number of people who can effectively work on an incident on a bridge? (With each new person joining , there is one more person to coordinate with).

Beth: The annoying answer is “it depends.”

You’re 100% right, each new person represents a new set of potential relationships. The “it depends” factors: If you have responders who have worked together a lot, have a shared model of “how to do this incident thing,” and are comfortable with decentralized coordination, then it’s generally not a problem until you hit a very large number of responders.

(An example of the latter situation: years ago, S3 went down. The org where I was working broke response out into sub-incidents, each with its own Incident Commander, and then a main Incident Commander coordinated among the various groups. That was needed because we had dozens of active responders all working on very different parts of the system at once.)

If you have a lot of people joining, but only a few people are actively responding, then it’s fine as long as the lurkers are reasonably quiet. Incident Commanders (or Coordinators, or Facilitators, or whatever you call that role) are helpful when you have a group of any size that lacks a common frame for how to coordinate during incidents, or when you have a large number of active responders and you need someone to impose some structure and clarity so that people aren’t working at cross-purposes. In my experience, most incidents have a just handful of active responders (even very large ones).

You might have 50 people in the channel, but only 5-6 are doing most of the talking. As long as the remaining 40+ people are sensible about how they contribute, things generally work smoothly. And a good Incident Commander will recognize when there’s too much noise and will firmly ask the people who aren’t contributing usefully to step back.

Detecting strong incident culture

Q: During interviews with a new company, what questions would you ask to make sure they have a good incident culture? and what are the statements that makes you run away if you hear them?

Beth: Good signs:

  • Incidents are not treated as a sign the company is failing. (There may be patterns arising in incidents that people don’t like, but the more explicit the company is that “incidents are going to happen, it’s not bad that we’re having them,” the better.)
  • Incidents are recognized as a useful-but-arbitrary category, so metrics around them don’t get heavily weighted. Teams have control over what action items they take on after incidents.
  • Incidents are treated a special type of routine work — that is, they’re treated as normal, expected, worth doing well, and worth making sense of afterwards.

What might make me run away (or run in and try to change things!):

  • Heavy top-down involvement during/after incidents (VPs barking orders at engineers during response, or leadership overriding teams’ roadmaps after a shallow postmortem).
  • Metrics worship (e.g. “our top goal is to reduce MTTR by 50%”; the sassy response is, “easy, stop declaring incidents”).
  • Product is completely disconnected from incidents and doesn’t account for operational reality in their product and roadmap planning.

How to reset post-incident

After incidents, it takes me hours to feel ‘normal’ again. Are there any quick hacks to shaking off that post-incident crash?

Beth: One of my favorite questions! And this really matters, because we lose so much as individuals AND as orgs to post-incident fatigue. Some things I’ve found effective for myself and colleagues:

1. Connecting to the body.

This could be a movement practice like walking, running, tai chi/qi gong, yoga, dance, whatever, or it could doing a body scan where you move your attention across top of head, sides of head, neck, shoulders, all the way down to your feet.

One reason this works is that post-incident stress is partly hyperactivity in the prefrontal cortex, and anything that moves neural activity out to the sensory cortex allows you to move out of that “tired but wired” feeling.

2. Breath work.

Could be a simple breath in to a 4 count, hold to a 4 count, breath out to a 7 count. Or could be more vigorous breathwork; Wim Hof is a nutty and compelling Dutch guy with 10-minute deep-breathing videos that work wonders. This works because breath patterns are tightly coupled to the nervous system and therefore signal the nervous system to shift out of highly activated fight-or-flight patterns into calmer rest-and-digest patterns.

3. Co-regulation.

We’re social creatures, so connecting to other biological beings is a powerful way to shift gears. If you have someone in your life who is reliably calm and grounded, whether a work colleague, friend, family member, whatever, you can spend time with them. They’re the tuning fork that can reset your physical system to a calmer note. Or cuddle a pet, sit with a tree, whatever you know will retune your system.

(And yes, there are cognitive practices that can be tremendously helpful as well, but I’ve found that the more physical the practice, the faster and more effective it is at shifting me out of high stress states.)

On perfecting a (post-incident) cocktail collection

Q: I don’t have a large cocktail cabinet, but I’d like to be nifty with the little I have. Any tips for transforming the mundane into something truly sippable?

John:

Yes! One thing I like to do is keep the structure of a “sour”: a spirit, a (sour) citrus, a sweetener.

Some common sweeteners you might have but never considered using in a cocktail: maple syrup, brown sugar, orange juice…these can make things really interesting!

Another thing that I’m still getting used to but I’ve seen people do amazing things with: herbal teas! Especially fruity ones.

Experiment!

Thanks for reading! Check out our sister article ‘My Boss Wants Me to Pick an AI SRE Tool

Sam Salter

Sam is the official editor at Uptime Labs, working closely with a global community of engineers and practitioners to surface real-world insights into incident response. Sam aims to help turn hard-won operational experience into clear, practical perspectives aiming to support how organisations prepare for, respond to and learn from incidents.

Share this post

Ready to make incident response your competitive advantage?

— Chris Voss

See how Uptime Labs builds provable, scalable incident response capability across your financial services organisation.