Increased Incident Counts Can Signal Improved Incident Management, Not Declining Reliability

Challenging Incident Volume as a Metric

A common assumption in engineering leadership is that more reported incidents mean less reliable systems. However, a recent article from Great Circle suggests that the opposite can be true. An increase in incident counts might indicate an organization's incident management culture is improving, not that its systems are failing more often.

Improved Visibility, Not Deterioration

When teams invest in better processes, tools, training, and operational discipline, they become more willing to formally declare incidents that might have previously been handled informally or hidden. This results in greater visibility into operational issues, which does not necessarily mean a deterioration in the underlying system health.

Incident Count Reflects Management Maturity

The article argues against using incident volume as a key performance indicator for reliability. Instead, incident count measures an organization's willingness to surface and manage operational problems. Mature incident management cultures encourage early incident declaration, stakeholder involvement, and structured post-incident reviews. While this can initially increase reported incidents, it also creates more opportunities for learning and process improvement, potentially preventing larger outages.

Parallel Across Engineering Disciplines

This phenomenon is observed in other engineering fields. For example, stronger vulnerability management often leads to more reported security findings because detection capabilities have improved, not because systems are suddenly less secure. Similarly, better observability can generate more alerts, and enhanced testing uncovers more defects before production. In each case, improved measurement reveals existing problems rather than creating new ones.

Enhanced Resilience Through Visibility

Incident management follows this pattern. Engineers who previously resolved issues quietly may now declare formal incidents, triggering coordinated responses, documentation, and postmortems. Although dashboards may show more incidents, the organization becomes more resilient by making operational knowledge visible and repeatable. This aligns with modern SRE practices that prioritize customer impact and recovery effectiveness over simplistic operational metrics.