Mock incidents

Mock incidents let your team practice incident response without real-world consequences. They simulate the full incident lifecycle in an isolated environment, making them ideal for training, onboarding, and readiness exercises.

How mock incidents work

Mock incidents behave identically to real incidents with three key differences:

1. Admin-only creation -- only organization admins can create mock incidents. This prevents accidental confusion with real incidents.
2. No real notifications -- mock incidents do not trigger PagerDuty escalations, Slack alerts to external channels, or status page updates. Internal notification behavior depends on your organization settings.
3. Auto-resolve timer -- each mock incident includes a configurable countdown timer. When the timer expires, the incident is automatically resolved regardless of its current status.

Creating a mock incident

1. Navigate to Incidents and click New Incident.
2. Toggle the Mock incident switch at the top of the form.
3. Fill in the title, severity, type, and description as you would for a real incident.
4. Set the auto-resolve timer (default: 60 minutes, maximum: 8 hours).
5. Click Create.

Mock incidents are clearly labeled with a banner on the incident detail page, so there is no ambiguity during the exercise.

Training scenarios

Here are recommended scenarios for mock incidents:

Scenario 1: P1 service outage

Simulate a complete outage of a core service. The team practices rapid Commander assignment, stakeholder communication, and coordination across multiple responders. Set the timer to 30 minutes to create urgency.

Scenario 2: P2 performance degradation

Simulate increasing latency on a public API. The team works through investigation, root cause analysis, and a gradual recovery. Good for practicing the Investigating to Identified transition. Set the timer to 45 minutes.

Scenario 3: P3 security event

Simulate a suspicious login pattern detection. The team practices coordination between engineering and security. Set the timer to 60 minutes.

Reviewing mock incident performance

After a mock incident resolves, the Commander and participants can review the timeline just like a real incident. Use the incident feedback flow to collect ratings and notes on what went well and what to improve.

Mock incident data is clearly separated from real incident metrics in your organization's analytics dashboard.

Best practices

• Schedule regular mock exercises (monthly is a good starting point).
• Rotate the Commander role so different team members gain experience.
• After each exercise, hold a short debrief to discuss lessons learned.
• Gradually increase complexity by introducing complications mid-exercise.
• Track mock incident metrics over time to measure improvement in response times.