Escalation Threshold Lab
It is 1am and an ambiguous signal just landed. Now the hard part: is it noise or the start of a SEV1? Who do you wake, and does this reach the CEO and board? Take the pager and make each call the way a seasoned incident commander would — classify on written criteria, not vibes; auto-escalate the objective triggers; escalate on uncertainty when the impact-if-true is severe; and de-escalate as explicitly as you escalate, so you miss no real SEV1 and never cry wolf. Each decision shows you why.
Pair this drill with the free Incident Escalation & Notification Matrix — the document that records the thresholds and routing you practise here. Educational drill, not legal advice.
The real job. More noise, a tighter clock.
It is after midnight and an ambiguous signal just landed. Work 10 on-call decisions — set the severity on written criteria, decide who gets woken, and avoid both the missed SEV1 and the pager nobody believes. You are graded on how many you call right against the clock.
What this lab is
- A free, browser-based decision drill on incident escalation: work ~14 on-call decisions about when an incident stops being an operational event and becomes something you wake the CEO and brief the board over.
- You set severity on written criteria — not vibes — and practise both failure modes: under-escalation (a real SEV1 treated as noise) and over-escalation (crying wolf that teaches leadership to mute the pager).
- You drill the objective SEV1 triggers (confirmed data exfiltration, spreading ransomware, safety impact, regulated-data exposure, a customer-facing outage past a set duration), who is woken at 2am, escalating on uncertainty for high-impact signals, and when legal, comms and the board get looped in.
- Each decision reveals why the defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal or professional advice. Pair it with the free Incident Escalation & Notification Matrix template.
Frequently asked questions
What is the Escalation Threshold Lab?
A free, in-browser decision simulation that puts you on the pager after an ambiguous signal lands overnight. You work through on-call and incident-command decisions — what severity is this, who gets woken, does this auto-escalate to the CEO and board — and each one has a single defensible answer, revealed after you lock in your call.
How do you avoid both under- and over-escalating?
By setting the threshold on objective, pre-agreed criteria rather than nightly instinct. Under-escalation — treating a true SEV1 as routine noise — costs the most, because the window to contain and mobilise leadership closes early. But over-escalation erodes the pager: once leadership learns the top tier is unreliable, they tune it out and the real SEV1 gets the same muted response. The lab drills a threshold that clears credible high-impact signals reliably without crying wolf.
Is this legal advice?
No. The lab is an educational drill. It touches regulatory-notification and disclosure concepts for orientation, but internal paging thresholds and external legal-notification duties differ by jurisdiction and change over time. Confirm the requirements that apply to your organisation with qualified counsel.
Who is it for?
On-call engineers, incident commanders, duty managers, SOC leads, CISOs and the executives who get paged — anyone who has to decide, at 2am, whether a signal is noise or the start of a board-level incident, and who wants to rehearse the call before it is real.