By Rob Schnepp & Ron Vidal
When an IT incident occurs, most organizations focus on one thing: restoring service as quickly as possible. Engineers troubleshoot, commanders lead, and communication channels fill with opinions, updates and ideas. Eventually the issue is resolved, a post-incident review is scheduled, and operations return to normal.
But an important question is rarely asked: What did that incident really cost the organization?
Based on the Blackrock 3 Partners framework of Responsonomics, incident response is examined through a microeconomic lens. The approach introduces a framework for understanding incidents not only as technical failures, but as economic events involving supply, demand, labor costs, and market perception. When these forces are examined carefully, incident response becomes more than a reactive technical activity—it becomes a system that can be measured, modeled, and optimized.
Supply: The Pipeline of Incidents
In traditional economics, supply refers to the quantity of goods or services available in a market. In Incident Management, supply can be thought of as the stream of incidents entering the operational system. Every alert, outage, or degraded service condition adds to the supply of operational problems that require human attention.
Over time, the rate at which incidents enter the system becomes an important operational characteristic. If incidents arrive sporadically and at manageable intervals, response teams can address each event methodically while maintaining focus on preventative work, system improvements, and innovation. However, when incidents begin to arrive more frequently, the supply of operational problems can quickly overwhelm available responders. Engineers may find themselves moving from one issue to the next with little opportunity to reflect, analyze root causes, or implement longer-term fixes. In this state, the operational environment shifts from proactive engineering to reactive firefighting.
Understanding incident supply therefore becomes an important part of operational maturity. Rather than treating incidents as isolated, unpredictable events, organizations can analyze patterns in the volume and timing of incoming alerts. Trends may emerge that reveal recurring failure conditions, infrastructure bottlenecks, or periods of elevated operational stress. By studying these patterns, teams gain insight into where preventive improvements may reduce the overall supply of incidents entering the system.
Ultimately, viewing Incident Management through the lens of supply encourages leaders and engineers to think beyond individual outages. It shifts attention toward the flow of operational work moving through the response system. Just as economists study how goods move through markets, operational leaders can examine how incidents move through their organizations. By understanding and managing this flow, teams can reduce unnecessary noise, focus attention on meaningful service disruptions, and create a more stable operational environment for both responders and the systems they support.
Demand: Matching Time, Tools, and Talent to the Incident
If incidents represent supply, then incident response resources represent demand.
In classical economics, demand describes how much of a product consumers want to purchase at a given price. In Responsonomics, demand refers to the combination of time, talent, and tools required to resolve incidents effectively. Every incident requires a specific mix of these three elements. Time refers to how long responders must work to investigate and mitigate the issue. Talent represents the expertise required—subject matter experts, engineers, operations staff, or security professionals. Tools include monitoring systems, automation platforms, diagnostic utilities, and collaboration environments.
When supply and demand are poorly balanced, operational strain quickly appears. If incident supply rises while response demand capacity remains fixed or unpredictable, teams become overloaded. Resolution slows. Responders experience fatigue and burnout. Work unrelated to incident response—such as development projects or strategic improvements—begins to stall. Operationally mature organizations treat incident demand forecasting with the same seriousness that retailers apply to forecasting customer demand. They study patterns in incident frequency, severity, duration, and time of occurrence. Over time, these patterns reveal insights that allow teams to allocate resources more intelligently.
For example, incident data may show that a large percentage of critical outages occur during specific deployment windows or during peak customer traffic periods. Armed with this information, organizations can adjust on-call coverage, automate detection systems, or strengthen preventive controls. Without this forecasting discipline, incident response becomes purely reactive.
Demand Modelling
Demand modeling helps organizations understand the operational workload created by incidents. By analyzing historical incident data—such as frequency, duration, business impact, and affected systems—leaders can develop more accurate staffing models and response strategies.
Demand modeling also helps answer several important questions:
Cost: It’s the People!
One of the most important ideas in Responsonomics is that incident response is fundamentally a labor-driven activity. Engineers, incident commanders, managers, communications specialists, and support staff all contribute time and attention during an outage. Each moment spent diagnosing problems, coordinating teams, and communicating status updates represents a measurable cost. Responsonomics simplifies this concept by grouping all participants in an incident response effort under a single economic term: labor.
Labor includes everyone involved in the response process, not just technical engineers. Executive leadership, communications teams, legal advisors, and customer support personnel may also participate in major incidents.
Many organizations instinctively respond to major incidents by assembling large groups of responders. The phrase “all hands on deck” often appears during high-severity outages. While this approach may feel reassuring, it can significantly increase incident cost. More importantly, larger groups often introduce communication complexity. Conversations multiply, troubleshooting efforts overlap, and decision-making slows. The result can be higher labor costs without faster resolution.
Responsonomics encourages a different mindset.
Effective incident response dispatches the right people with the right skills at the right time. Responders should be selected intentionally based on the needs of the incident, not curiosity or organizational habit. Those who are not actively contributing can remain informed through notification channels without participating directly in troubleshooting discussions. In other words, incident response should emphasize contribution over lurking!
The Dimensions of Price
While cost reflects internal resource consumption, Responsonomics introduces another concept: price.
Price represents how the world outside the company, and the people inside it experience an incident. It includes reputational impact, internal facing business impact, customer trust, and market perception. Two incidents with identical technical causes may produce dramatically different outcomes depending on how the organization responds.
If communication is clear, updates are timely, and customers feel respected throughout the event, the reputational price may remain relatively small. However, when communication is delayed or confusing, customers may lose confidence. Social media narratives may spread quickly. Analysts, regulators, or industry observers may question the organization’s operational maturity.
In these cases, the reputational price of the incident can far exceed the internal labor cost required to fix the problem. This dynamic explains why some major incidents become defining moments for organizations. Long after systems are restored, the market remembers how the company handled the crisis.
Price is not simply something organizations endure—it is something they can influence. Preparation, training, communication discipline, and operational maturity all shape how incidents are perceived by customers and stakeholders. Organizations can choose to pay the price of incidents in one of two ways. They can invest in preparedness—training responders, refining communication strategies, and building resilient incident management programs. Or they can pay later through customer churn, reputational damage, and loss of trust.
Responsonomics encourages leaders to treat incident response as a business system that deserves the same analytical attention applied to revenue forecasting or cost control.
Because every IT incident, when viewed through the right lens, is simply a business problem in disguise. Our next post will describe a financial model for determining the base price of an incident and the concepts of opportunity cost and internal business impact.
When an IT incident occurs, most organizations focus on one thing: restoring service as quickly as possible. Engineers troubleshoot, commanders lead, and communication channels fill with opinions, updates and ideas. Eventually the issue is resolved, a post-incident review is scheduled, and operations return to normal.
But an important question is rarely asked: What did that incident really cost the organization?
Based on the Blackrock 3 Partners framework of Responsonomics, incident response is examined through a microeconomic lens. The approach introduces a framework for understanding incidents not only as technical failures, but as economic events involving supply, demand, labor costs, and market perception. When these forces are examined carefully, incident response becomes more than a reactive technical activity—it becomes a system that can be measured, modeled, and optimized.
Supply: The Pipeline of Incidents
In traditional economics, supply refers to the quantity of goods or services available in a market. In Incident Management, supply can be thought of as the stream of incidents entering the operational system. Every alert, outage, or degraded service condition adds to the supply of operational problems that require human attention.
Over time, the rate at which incidents enter the system becomes an important operational characteristic. If incidents arrive sporadically and at manageable intervals, response teams can address each event methodically while maintaining focus on preventative work, system improvements, and innovation. However, when incidents begin to arrive more frequently, the supply of operational problems can quickly overwhelm available responders. Engineers may find themselves moving from one issue to the next with little opportunity to reflect, analyze root causes, or implement longer-term fixes. In this state, the operational environment shifts from proactive engineering to reactive firefighting.
Understanding incident supply therefore becomes an important part of operational maturity. Rather than treating incidents as isolated, unpredictable events, organizations can analyze patterns in the volume and timing of incoming alerts. Trends may emerge that reveal recurring failure conditions, infrastructure bottlenecks, or periods of elevated operational stress. By studying these patterns, teams gain insight into where preventive improvements may reduce the overall supply of incidents entering the system.
Ultimately, viewing Incident Management through the lens of supply encourages leaders and engineers to think beyond individual outages. It shifts attention toward the flow of operational work moving through the response system. Just as economists study how goods move through markets, operational leaders can examine how incidents move through their organizations. By understanding and managing this flow, teams can reduce unnecessary noise, focus attention on meaningful service disruptions, and create a more stable operational environment for both responders and the systems they support.
Demand: Matching Time, Tools, and Talent to the Incident
If incidents represent supply, then incident response resources represent demand.
In classical economics, demand describes how much of a product consumers want to purchase at a given price. In Responsonomics, demand refers to the combination of time, talent, and tools required to resolve incidents effectively. Every incident requires a specific mix of these three elements. Time refers to how long responders must work to investigate and mitigate the issue. Talent represents the expertise required—subject matter experts, engineers, operations staff, or security professionals. Tools include monitoring systems, automation platforms, diagnostic utilities, and collaboration environments.
When supply and demand are poorly balanced, operational strain quickly appears. If incident supply rises while response demand capacity remains fixed or unpredictable, teams become overloaded. Resolution slows. Responders experience fatigue and burnout. Work unrelated to incident response—such as development projects or strategic improvements—begins to stall. Operationally mature organizations treat incident demand forecasting with the same seriousness that retailers apply to forecasting customer demand. They study patterns in incident frequency, severity, duration, and time of occurrence. Over time, these patterns reveal insights that allow teams to allocate resources more intelligently.
For example, incident data may show that a large percentage of critical outages occur during specific deployment windows or during peak customer traffic periods. Armed with this information, organizations can adjust on-call coverage, automate detection systems, or strengthen preventive controls. Without this forecasting discipline, incident response becomes purely reactive.
Demand Modelling
Demand modeling helps organizations understand the operational workload created by incidents. By analyzing historical incident data—such as frequency, duration, business impact, and affected systems—leaders can develop more accurate staffing models and response strategies.
Demand modeling also helps answer several important questions:
- How many responders are typically required during high-severity incidents?
- How often do incidents occur during peak traffic periods?
- Which technologies generate the highest operational workload?
- Where might automation reduce human intervention?
- What is the cost of human attention during a high severity incident
Cost: It’s the People!
One of the most important ideas in Responsonomics is that incident response is fundamentally a labor-driven activity. Engineers, incident commanders, managers, communications specialists, and support staff all contribute time and attention during an outage. Each moment spent diagnosing problems, coordinating teams, and communicating status updates represents a measurable cost. Responsonomics simplifies this concept by grouping all participants in an incident response effort under a single economic term: labor.
Labor includes everyone involved in the response process, not just technical engineers. Executive leadership, communications teams, legal advisors, and customer support personnel may also participate in major incidents.
Many organizations instinctively respond to major incidents by assembling large groups of responders. The phrase “all hands on deck” often appears during high-severity outages. While this approach may feel reassuring, it can significantly increase incident cost. More importantly, larger groups often introduce communication complexity. Conversations multiply, troubleshooting efforts overlap, and decision-making slows. The result can be higher labor costs without faster resolution.
Responsonomics encourages a different mindset.
Effective incident response dispatches the right people with the right skills at the right time. Responders should be selected intentionally based on the needs of the incident, not curiosity or organizational habit. Those who are not actively contributing can remain informed through notification channels without participating directly in troubleshooting discussions. In other words, incident response should emphasize contribution over lurking!
The Dimensions of Price
While cost reflects internal resource consumption, Responsonomics introduces another concept: price.
Price represents how the world outside the company, and the people inside it experience an incident. It includes reputational impact, internal facing business impact, customer trust, and market perception. Two incidents with identical technical causes may produce dramatically different outcomes depending on how the organization responds.
If communication is clear, updates are timely, and customers feel respected throughout the event, the reputational price may remain relatively small. However, when communication is delayed or confusing, customers may lose confidence. Social media narratives may spread quickly. Analysts, regulators, or industry observers may question the organization’s operational maturity.
In these cases, the reputational price of the incident can far exceed the internal labor cost required to fix the problem. This dynamic explains why some major incidents become defining moments for organizations. Long after systems are restored, the market remembers how the company handled the crisis.
Price is not simply something organizations endure—it is something they can influence. Preparation, training, communication discipline, and operational maturity all shape how incidents are perceived by customers and stakeholders. Organizations can choose to pay the price of incidents in one of two ways. They can invest in preparedness—training responders, refining communication strategies, and building resilient incident management programs. Or they can pay later through customer churn, reputational damage, and loss of trust.
Responsonomics encourages leaders to treat incident response as a business system that deserves the same analytical attention applied to revenue forecasting or cost control.
Because every IT incident, when viewed through the right lens, is simply a business problem in disguise. Our next post will describe a financial model for determining the base price of an incident and the concepts of opportunity cost and internal business impact.
About the Authors
Rob Schnepp’s incident response career spans 30 years in international public safety as a Special Operations Fire Chief, Incident Commander, consultant and published author. Rob is one of the founders of Blackrock 3 Partners, an incident management consulting firm.
Rob Schnepp’s incident response career spans 30 years in international public safety as a Special Operations Fire Chief, Incident Commander, consultant and published author. Rob is one of the founders of Blackrock 3 Partners, an incident management consulting firm.