Focusing on successes as well as failures reduces negativity bias in postmortems.

Incidents happen. They’re loud, urgent, and often stressful. When the smoke clears, teams tend to replay what went wrong in every detail. That’s natural, but it’s also a trap. The human mind leans toward negative news, a phenomenon researchers call negativity bias. In incident reviews, that bias can push us to miss the elements that actually moved the needle for good outcomes. If we want faster recovery and smarter improvements, we need a deliberate counterbalance. Enter a simple, powerful strategy: focus on successes as well as failures.

Let me explain why this works. When a pager alert hits, the clock starts ticking. Tensions rise. People jump into action, and the story that sticks is the one about what failed—missed signals, confusing runbooks, long MTTR. But there are often silver linings baked into the chaos: a quick decision that halved the downtime, a monitoring check that caught a cascading issue early, a teammate’s quick collaboration that prevented a bigger blast. By naming and celebrating those successes alongside the mistakes, teams shift from a blame-driven narrative to a learning-driven one. The result isn’t soft; it’s practical. It creates a safer space to discuss what actually helps in the moment, so the whole team can repeat it.

Here’s the core idea in plain terms: a balanced post-incident review digs into both what went well and what didn’t. It’s not about patting people on the back or losing sight of the real issues; it’s about extracting a complete picture so you can replicate strengths and fix gaps. This approach fits naturally with PagerDuty’s strengths—coordinated alerts, on-call rigor, and a culture that values learning as much as uptime. When you frame the discussion this way, you get a clearer map of how to reduce MTTR, improve escalation paths, and strengthen the team’s confidence for the next incident.

What a balanced review looks like in practice

• Start with wins, then pivot to the gaps. A quick “What went right” section helps set a constructive tone. It reminds everyone that the team did something right under pressure, and that behavior is worth repeating.

• Ground the conversation in data, not guesses. Let the facts guide the discussion: alert timings, on-call rotations, response times, and the sequence of actions. These data points can reveal why a success happened—or why a failure spiraled.

• Frame failures as learnings, not personal faults. A blame-free environment isn’t soft; it’s strategic. People perform best when they’re encouraged to speak up about what confused them or slowed them down, without fear of retribution.

• Capture repeatable actions. Identify steps the team can replicate when similar incidents occur. If a particular play or decision chain consistently yields a fast recovery, call it out and codify it.

• Close on action and morale. Finish with concrete improvements and a sense of momentum. When people leave the room feeling trusted and capable, motivation follows.

Practical steps to weave success into postmortems

1. Use a two-layer structure. Have a “What went well” brief, followed by the traditional breakdown of what failed and what can be improved. This dual layer keeps the tone balanced and makes the session feel productive, not punitive.

2. Build a wins-in-review section into your post-incident template. It can be a simple list: early detection, accurate alert routing, effective on-call collaboration, fast containment, clean handoffs to engineering, or smooth customer communication. Each item should note why it mattered and how to repeat it.

3. Tie successes to concrete actions. For every successful moment, ask: What exactly caused that success? What would we change in future incidents to ensure we can rely on that same action again? Turning a win into a repeatable practice is the key.

4. Normalize near misses as valuable signals. Sometimes the most informative moments aren’t the dramatic outages but near misses that almost grew into bigger issues. Treat these as opportunities to learn, not as cheap thrills.

5. Celebrate teams and behaviors, not just outcomes. The hero moments deserve recognition, but so do the day-to-day patterns that keep a recovery moving smoothly. Acknowledge people who communicated clearly, who kept to the runbook, who asked the right questions at the right time.

6. Keep the pace human. Postmortems should feel like a collaborative problem-solving session, not an interrogation. A relaxed tempo helps people speak candidly and reduces defensiveness. A little humor at the right moment can ease tension, as long as it stays respectful and on point.

A practical postmortem flow you can borrow

• Pre-meeting setup: Share the incident timeline, the alert metrics, and the initial assessment. Invite participants to note both positive actions and points of confusion they observed.

• Opening round: A quick round of “What went well?” followed by “What didn’t go as planned?” This keeps minds open and reduces the temptation to rush to conclusions.

• Deep dive on interventions: Break down the actions taken, who led them, and why those choices worked or failed. Look for patterns—whether certain runbooks, dashboards, or chat channels consistently helped.

• Root cause with but not blame: Identify systemic factors that contributed to the outage, while keeping the focus on process improvements rather than naming individuals.

• Lessons in context: Capture learnings that apply beyond the incident—what to train, what monitoring to tweak, what automation to add.

• Action menu: Assign owners, set realistic timelines, and tie items to measurable outcomes. This step is crucial for turning insight into impact.

• Close with a morale boost: Acknowledge teamwork, express gratitude for the candor, and highlight a couple of concrete wins that are about to be reinforced.

Why focusing on successes matters for incident response teams

• It reinforces good habits. If you consistently call out what worked, those actions are more likely to recur in future incidents. That means faster containment, cleaner restorations, and happier customers.

• It boosts psychological safety. People speak up more readily when they’re assured that the goal is learning, not scolding. That safety is the engine of continuous improvement.

• It preserves momentum during tough times. Negative bias can drain energy fast. Balanced reviews create a sense of progress and resilience, helping teams bounce back stronger.

• It broadens perspective. The bright spots spotlight strategies you can scale. Sometimes a clever workaround in one incident becomes the standard play in the next.

Common challenges and gentle countermeasures

• Challenge: Silence after asking for wins. If teams feel they’re expected to only discuss the negatives, they may clam up.

Countermeasure: Normalize wins by giving a concrete prompt and a short timebox. Leaders should model this behavior by sharing one personal win and one learning moment.

• Challenge: Focusing too much on numbers without context. Metrics matter, but they need story to land.

Countermeasure: Pair metrics with narrative. For example, “MTTR improved from 22 to 12 minutes thanks to X,” then explain what changed in the workflow to make that drop possible.

• Challenge: Blame creeping in under pressure.

Countermeasure: Establish a blameless principle beforehand and have a neutral facilitator. Acknowledge emotions privately if needed, but keep the room focused on systems and processes.

• Challenge: Repeating the same fixes without verifying impact.

Countermeasure: Add a check-in step later—after a couple of weeks—to confirm whether the action reduced the same kind of incident or if it needs tweaking.

Paint a mental model you can carry forward

Think of incident response like running a sports team. When you win a game, you don’t just celebrate the victory; you study the passes that worked, the defensive setups that held, and the substitutions that made the difference. You also review what threw you off—so you can tighten your defense and sharpen your offense for the next matchup. Similarly, a balanced postmortem treats the incident as a shared game plan in progress. It’s a living playbook that rewards repetition of the good moves and quick adaptation when things go awry.

If you’re using PagerDuty as your nerve center for alerts and collaboration, you already have a set of tools that can support this approach. The platform helps teams coordinate response, log actions, and review outcomes in a structured way. The key is to layer in the positive findings alongside the problems, so the review feels like a constructive checkpoint rather than a courtroom. When the data supports both wins and lessons, you get a fuller picture of how your on-call culture, runbooks, and automation contribute to uptime—and where they fall short.

A closing thought: you don’t have to choose between better reliability and team morale. Focusing on successes as well as failures creates a richer, more actionable narrative. It preserves energy, builds trust, and clarifies what to repeat—and what to improve. In the busy world of incident response, that balanced lens can be the difference between a one-off fix and a stronger, more resilient team.

If you’re thinking about your next post-incident session, try starting with a deliberate pause for wins. Give your team a moment to name the parts that clicked, then move into the challenges with curiosity, not accusation. You’ll likely notice two powerful shifts: faster learning and steadier nerves. And that combination—clear actions plus confident teamwork—just might be the most practical upgrade of all.

Would you try this approach at your next incident review? If you do, start with a simple question: what went right, and why did it matter? You might be surprised by how much those answers propel your team forward.