On the topic of Incident Analysis, I don't believe the industry has a "dissemination" problem - that they produce post-incident write-ups but people just won't take the time to read them.
It seems many think this is the case. I don't.
It seems many think this is the case. I don't.
I believe that the skills necessary to produce quality, compelling and genuinely insightful write-ups is in very short supply.
(I also think the allure of "template-driven postmortems" unfortunately enables this poor quality to continue.)
(I also think the allure of "template-driven postmortems" unfortunately enables this poor quality to continue.)
People aren't reading (and commenting, and highlighting, and referencing, and asking questions) about them because they don't (typically) reveal anything of interest for the reader!
Doing this well can be done, and the results are undeniable when this expertise exists!
Doing this well can be done, and the results are undeniable when this expertise exists!
We've seen "standing room only" post-incident review meetings, attended by engineers because they "can learn things there that they can't anywhere else"
We've seen write-ups that have many unique daily readers who are still talking about an event 3-6 months later.
We've seen write-ups that have many unique daily readers who are still talking about an event 3-6 months later.
We've seen multiple highlights and comments appear on write-ups by members of multiple (sometimes "distant") groups
"wait what? I had no idea it worked like this"
"this is exactly what our group was wrestling with yesterday!"
"I thought this was straightforward...clearly not!"
"wait what? I had no idea it worked like this"
"this is exactly what our group was wrestling with yesterday!"
"I thought this was straightforward...clearly not!"
Yes this thread is self-serving (because I work for @AdaptiveCLabs) but the gap in what the industry *thinks* learning from incidents means and what it *actually* means is real, and it's wider than the industry thinks.
What does progress look like? It’s not fewer incidents, to be sure:
