Key Takeaways
- 01A blameless postmortem is necessary but not sufficient. The actual learning happens in the weeks and months after, in the form of tracked improvements, updated detection content, and inclusion of the scenario in future exercises.
- 02Follow-through artifacts: tracked remediation actions with named owners and dates, new detection content for the technique used in the incident, tabletop exercise scenario based on the incident, updates to runbooks/escalation paths/documentation, lessons-learned shared cross-team with the author present.
- 03What to share, what to protect: share the technical and process lessons broadly; protect the human details (who made which decision under pressure) for psychological safety. Without that distinction, postmortems become political and the team stops bringing real near-misses forward.
- 04Re-test the lesson: six months after a significant incident, run a tabletop using a variation of the same scenario. Materially better response means the learning landed; same response means the postmortem produced a document, not a change.
A blameless postmortem is necessary but not sufficient. The actual learning happens in the weeks and months after, in the form of tracked improvements, updated detection content, and inclusion of the scenario in future exercises.
The follow-through artifacts
- 01Tracked remediation actions with named owners and dates
- 02New detection content for the technique used in the incident
- 03Tabletop exercise scenario based on the incident
- 04Updates to runbooks, escalation paths, and documentation
- 05Lessons-learned shared cross-team, with the author present
What to share, what to protect
Share the technical and process lessons broadly. Protect the human details — who made which decision under pressure — for psychological safety. Without that distinction, postmortems become political and the team stops bringing real near-misses forward.
Re-test the lesson
Six months after a significant incident, run a tabletop using a variation of the same scenario. If the team responds materially better, the learning landed. If they do not, the postmortem produced a document, not a change.
#Postmortem#Learning#SRE