Severity: P1 / Sev 1 · Updated May 2026

P1 Incident Cost: What a Severity-1 Outage Costs in 2026

Q: What is the average cost of a P1 incident?

PagerDuty's State of Digital Operations 2024 puts the average cost of a P1 (Severity 1) incident at approximately $794,000. The figure aggregates across surveyed organisations and excludes outliers; medium-to-large enterprises with high revenue concentration in digital channels typically see P1 costs in the $1M-$10M range. The PagerDuty methodology counts direct response cost, productivity loss, and customer-facing revenue impact during the incident.

Q: What counts as a P1 incident?

P1 (Priority 1) or Sev 1 (Severity 1) is the highest incident severity in standard ITIL and SRE incident-classification schemes. Common P1 triggers: full production outage, customer-facing service unavailable, security incident with active data exfiltration, complete loss of a critical business function, or a widespread issue affecting more than 10% of the customer base. Most organisations require executive notification within 15-30 minutes of P1 declaration.

Q: What is MTTA versus MTTR and how do they affect cost?

MTTA (Mean Time to Acknowledge) is the time from alert to a human acknowledging the incident. MTTR (Mean Time to Resolve) is the time from incident start to incident closure. Cost scales with both, but MTTR is the dominant driver. Halving MTTR from 2 hours to 1 hour on a $50K/hour-revenue service saves $25K per incident in opportunity cost alone, before counting customer-impact and reputational cost.

Q: How much does on-call infrastructure cost?

A robust on-call infrastructure for a mid-size engineering organisation runs $30K-$300K annually. Components: incident-management platform (PagerDuty, Opsgenie, FireHydrant, Rootly) at $20-$60 per user per month, 24x7 escalation rotation costing $10K-$50K annually in on-call differential pay per engineer in rotation, runbook maintenance and quarterly DR testing. The total compares favourably with the $794K cost of a single un-managed P1.

Q: What does an incident commander cost?

Most organisations rotate the incident-commander role through senior SRE and engineering management staff rather than maintaining a dedicated headcount. Loaded cost of an experienced incident commander running a P1 for 4 hours at $200/hour fully-loaded plus on-call differential is approximately $1,200 per incident. The bigger cost is the time of the supporting responders (typically 5-15 engineers active during a P1), which adds $4,000-$24,000 in direct labor cost per hour of incident duration.

Q: What is the cost of post-incident review (PIR) work?

A blameless post-incident review for a major P1 typically consumes 40-80 person-hours across the responding team and adjacent stakeholders, costing approximately $8,000-$25,000 in direct labor. Action-item implementation typically adds 20-200 person-hours of follow-up engineering work depending on root-cause depth. Organisations that skip rigorous PIR work systematically incur 3-5x higher repeat-incident rates per Atlassian Incident Management Research and similar industry data.

Q: How does P1 incident cost scale with company size?

Cost scales sub-linearly with headcount but super-linearly with revenue concentration in digital channels. A 100-engineer company doing $20M ARR sees P1 costs in the $50K-$300K range. A 1,000-engineer company doing $500M ARR sees P1 costs in the $500K-$3M range. A 10,000-engineer company doing $10B ARR (typical large public SaaS) sees P1 costs in the $5M-$50M range. The non-linearity comes from the larger blast radius and the higher per-incident customer-impact cost at scale.

$794K

Avg P1 cost

15-30 min

Exec notification

5-15

Active responders

40-80 hrs

PIR effort

A P1 (Priority 1) or Sev 1 (Severity 1) incident is the highest-severity incident classification in standard incident-management taxonomy. The PagerDuty State of Digital Operations 2024 survey puts the average direct cost of a P1 at approximately $794,000 across surveyed organisations. The figure understates the cost at large public-facing SaaS providers (where multi-million-dollar P1 events are common) and overstates it at smaller organisations with low digital-revenue concentration. This page breaks down the cost stack, the MTTA/MTTR economics that drive it, and the on-call investment that compresses it.

What Counts as P1

Severity classification varies by organisation but converges on a small set of common P1 triggers. The ITIL convention, refined through SRE practice at Google and elsewhere, uses three independent dimensions: customer impact, scope of affected functionality, and revenue or safety implications. A P1 is typically declared when at least one of the following holds.

Full production outage. The primary customer-facing service is completely unavailable.
Critical business function lost. Order processing, payment, authentication, or another core capability is non-functional even if other features work.
Active security exfiltration. Detected attack traffic with active data egress requires immediate response and containment.
Major customer-base impact. More than approximately 10% of the customer base is affected, or any single enterprise customer above a defined revenue threshold is impacted.
Safety implication. In sectors with safety-critical software (medical devices, automotive, industrial), any incident with potential safety impact is automatically P1.
Regulatory threshold. Any incident likely to trigger a regulatory disclosure (SEC 8-K materiality, GDPR Art. 33 reportability, HIPAA breach notification) is typically declared P1 to align response intensity with disclosure obligations.

Mature organisations also have an explicit "P0" or "Sev 0" tier above P1, reserved for catastrophic events with imminent enterprise-existential implications (active ransomware encryption underway, SEC-disclosure-mandatory event, public-safety incident). Most surveys roll P0 into P1 reporting.

The P1 Cost Stack

The PagerDuty $794K headline is an aggregate of five distinct cost components. Different organisations weight them differently depending on revenue model, customer concentration, and SLA exposure.

Cost Component	Range (mid-market)	Driver
Direct response labor	$10K-$100K	5-15 responders * hours * loaded rate; doubles for overnight events
Customer-facing revenue impact	$100K-$2M	Revenue-per-minute * outage duration; varies wildly by sector
SLA credit liability	$10K-$500K	Affects B2B SaaS more than B2C; tiered by uptime achieved
Customer-trust impact	$50K-$2M (quantified)	Churn risk, expansion delay, NPS impact; harder to measure but real
Post-incident review and remediation	$10K-$200K	PIR effort plus action-item implementation

The $794K PagerDuty figure broadly aligns with the sum of these components for a mid-market technology firm with moderate B2B SaaS revenue concentration. Larger organisations with stronger revenue concentration on digital channels (e-commerce, fintech, large SaaS) typically see costs an order of magnitude higher.

MTTA and MTTR: The Two Numbers That Drive Cost

Mean Time to Acknowledge (MTTA) and Mean Time to Resolve (MTTR) are the two operational metrics that directly drive P1 cost. MTTA is the time from automated alert to a human acknowledging the incident; MTTR is the time from incident start to incident resolution and customer-impact cessation.

Metric	Industry-mature target	Cost Impact of 50% Improvement
MTTA	<5 minutes	Reduces customer-impact window by alert delay; typically $5K-$50K savings per P1
MTTR	<1 hour for major P1	Halves customer-impact revenue loss; $50K-$500K savings per P1 for mid-market
MTTI (investigate)	<30 minutes	Sub-component of MTTR; observability tooling primarily
MTBF (between failures)	depends on service tier	Engineering investment in reliability; long-term yield

The MTTR-cost relationship is approximately linear once the incident is detected and acknowledged: every halving of MTTR halves the customer-impact revenue loss for the duration of the impact period. The investment in MTTR reduction (better observability, runbooks, automation, rehearsed game-day exercises) is one of the highest-ROI areas of engineering investment for any organisation with meaningful digital revenue. The full MTTD/MTTR cost impact analysis covers the optimisation curves in detail.

The On-Call Investment That Compresses P1 Cost

A robust on-call infrastructure investment is one of the most leveraged spends in incident-cost reduction. The total annual cost of mature on-call for a mid-size engineering organisation (50-300 engineers) runs $50K-$500K and reduces per-P1 cost by 40-70% versus an ad-hoc setup.

Investment Component	Annual Cost	Cost-Reduction Mechanism
Incident-management platform	$15K-$200K	PagerDuty, Opsgenie, FireHydrant, Rootly, incident.io ($20-$60/user/month)
On-call differential pay	$10K-$150K	Typically $1K-$3K per week of primary on-call; varies by region
Observability stack (P1-relevant tier)	$30K-$1M+	Datadog, New Relic, Grafana, Honeycomb tier; reduces MTTI dramatically
Runbook maintenance	$10K-$50K	Quarterly review and rehearsal; mostly internal time
Game days / chaos engineering	$20K-$200K	Quarterly major exercises; tooling plus engineering time

For an organisation experiencing 4-12 P1s per year, the on-call investment pays back in fewer than two prevented P1s. The arithmetic is robust across organisation sizes: at the small end, the absolute spend is smaller and the per-P1 savings are smaller proportionally; at the large end, both scale up but the ratio holds.

Frequently Asked Questions

What is the average cost of a P1 incident?

PagerDuty's State of Digital Operations 2024 puts the average cost of a P1 (Severity 1) incident at approximately $794,000. Medium-to-large enterprises with high revenue concentration in digital channels typically see P1 costs in the $1M-$10M range.

What counts as a P1 incident?

P1 (Priority 1) or Sev 1 is the highest incident severity in standard ITIL and SRE classification schemes. Common P1 triggers: full production outage, customer-facing service unavailable, security incident with active data exfiltration, complete loss of a critical business function, or a widespread issue affecting more than 10% of the customer base.

What is MTTA versus MTTR and how do they affect cost?

MTTA (Mean Time to Acknowledge) is time from alert to a human acknowledging the incident. MTTR (Mean Time to Resolve) is time from incident start to closure. Cost scales with both, but MTTR is the dominant driver. Halving MTTR from 2 hours to 1 hour on a $50K/hour-revenue service saves $25K per incident in opportunity cost alone.

How much does on-call infrastructure cost?

A robust on-call infrastructure for a mid-size engineering organisation runs $50K-$500K annually. Components: incident-management platform at $20-$60 per user per month, 24x7 escalation rotation costing $10K-$50K annually in on-call differential pay per engineer in rotation, runbook maintenance and quarterly DR testing.

What does an incident commander cost?

Most organisations rotate the incident-commander role through senior SRE and engineering management staff. Loaded cost of an experienced incident commander running a P1 for 4 hours at $200/hour fully-loaded plus on-call differential is approximately $1,200 per incident. The bigger cost is the time of supporting responders (typically 5-15 engineers active during a P1), which adds $4,000-$24,000 in direct labor cost per hour of incident duration.

What is the cost of post-incident review (PIR) work?

A blameless post-incident review for a major P1 typically consumes 40-80 person-hours across the responding team and adjacent stakeholders, costing approximately $8,000-$25,000 in direct labor. Action-item implementation typically adds 20-200 person-hours of follow-up engineering work. Skipping rigorous PIR work systematically incurs 3-5x higher repeat-incident rates.

How does P1 incident cost scale with company size?

Cost scales sub-linearly with headcount but super-linearly with revenue concentration in digital channels. A 100-engineer company doing $20M ARR sees P1 costs of $50K-$300K. A 1,000-engineer company doing $500M ARR sees $500K-$3M. A 10,000-engineer company doing $10B ARR sees $5M-$50M.