🆘 Pulling In More Help During an Incident: Escalation in Practice

There’s a moment in a lot of incidents where the responder knows, somewhere in the back of their mind, that they’re stuck — and keeps going alone anyway. Twenty more minutes of the same failing approach, because pulling in more people feels like admitting you couldn’t handle it. That reluctance is one of the most expensive habits in incident response. Every minute you spend stuck-and-solo is a minute of customer impact that a second brain, or the right specialist, might have ended.

Escalation policy — the paging chains and who’s on the hook — is worth designing carefully, and we’ve written about that elsewhere. This is about escalation in the moment: the human judgment of when to stop soldiering on and pull in help, and how to do it cleanly and without ego. It’s a skill, and like most incident skills it’s mostly about having decided the rules before the pressure hits.

The reluctance is the bug

Let’s name the thing directly. Good engineers under-escalate because escalating feels like failure. It isn’t. In a healthy incident culture, pulling in help early is a sign of judgment, not weakness — it means you correctly assessed that the incident was bigger than one person and acted on it. The engineers who impress me in a crisis aren’t the ones who solo the fix; they’re the ones who recognize fast when they’re out of depth and get the right people in the room without drama.

If your culture punishes or quietly judges people for escalating, they’ll wait too long, and the waiting is what costs you. The fix is cultural first: make asking for help the normal, respected default, so nobody burns twenty minutes protecting their ego while customers are down.

Triggers: when to pull in help

Don’t rely on in-the-moment judgment alone — judgment is exactly what degrades under stress and fatigue. Write down triggers that make the decision for you:

PULL IN MORE HELP WHEN ANY OF THESE IS TRUE:

[ ] Time box blown: you set out to try X for 15 min and it's
    been 15 min with no progress. Escalate, don't extend.
[ ] Impact is growing while you work. More impact = more hands.
[ ] It's outside your area: the failing thing is owned by a
    team or specialist who'll diagnose it in minutes.
[ ] You're guessing. If you're out of concrete hypotheses,
    a fresh brain finds new ones.
[ ] You need a decision above your authority (customer comms,
    a risky rollback, spending money, waking a VP).
[ ] You're fading. Tired, been at it too long, need a hand-off
    or a partner. Fatigue causes mistakes.
[ ] It's a SEV1, full stop. Big incidents are team sports.

The time-box trigger is the single most useful one. Before you start an approach, say out loud “I’m going to try rolling back the cache config, give me ten minutes.” When ten minutes is up with no progress, that’s not a moment to push harder — it’s the pre-committed signal to escalate. Deciding the time box before you’re in the tunnel is what saves you from the sunk-cost pull of “just five more minutes” that stretches into forty.

How to escalate cleanly

A good ask for help transfers context fast so the person you’re pulling in is useful in minutes, not after ten minutes of “so what’s going on?” A template:

🆘 PULLING YOU IN — [incident/channel]
What's broken: [symptom + customer impact]
Severity: SEVx | Started: [time]
What I've tried: [1-2 lines — including what DIDN'T work]
Current hypothesis: [or "out of ideas"]
What I need from you: [specific — "eyes on the DB", "decide
  on rollback", "own comms", "take the pager, I'm fading"]
Where: [channel / bridge link]

The two lines that make this land: what didn’t work (so they don’t repeat your dead ends) and what I need from you (a specific ask, not a vague “help”). “Can you look at the database, connection count is climbing and restarts aren’t helping” gets you a useful colleague fast. “It’s broken, help” gets you another confused person.

Escalating up vs. escalating out

Two different directions, two different purposes:

• Escalating out — pulling in more or different hands: the service owner, a specialist, a second responder for a fresh perspective, or someone to take a role (comms, scribe) off your plate. This is about capacity and expertise.
• Escalating up — pulling in authority: a manager or senior leader for a decision you can’t or shouldn’t make alone — a costly rollback, a public disclosure, waking a whole team, a call with real business trade-offs. This is about decision rights, not debugging.

Know which one you need. Pulling a VP into a debugging session doesn’t add hands; pulling in a specialist doesn’t get you sign-off on a risky call. And when you escalate up, be crisp about what decision you’re asking for — leaders who join an incident without a clear question tend to add coordination overhead instead of removing it.

Common mistakes

• Waiting too long. The default failure. Pre-commit to time boxes so the decision isn’t left to eroding judgment.
• The vague ask. “Help” makes the helper start from zero. Say specifically what you need and share what you already tried.
• Escalating in the wrong direction. Pulling in authority when you needed hands, or vice versa. Diagnose which you’re short on.
• Ego-protecting. Soldiering on solo to avoid looking stuck. Reframe: fast escalation is good judgment, and the culture should reward it.
• Not handing off when fading. Tired responders make mistakes and tunnel. “Take the pager, I need twenty minutes” is a strength, not a failure.

Where AI fits — a fresh brain before you page one

Sometimes the help you need first isn’t a human. When you’re stuck and out of hypotheses, a model is a genuinely useful “fresh brain” that costs nobody’s sleep: paste the symptoms and what you’ve ruled out and ask for a ranked set of new hypotheses and the read-only diagnostics to check each one. It won’t be right about everything, but it reliably surfaces the angle you’d stopped considering — and it does it without waking a colleague. That said, it’s a supplement to human escalation, not a replacement: for authority decisions, specialist knowledge, or simply another set of hands on the keyboard, you still need people. Use AI to break your own tunnel vision, and use the triggers above to know when it’s time to bring in humans anyway. The Incident Response tool can generate that ranked hypothesis set from raw symptoms.

Wrapping up

Pulling in help is a core incident skill, and the hard part is entirely about overcoming the reluctance to do it. Pre-commit to time boxes so you escalate on a trigger instead of a feeling, know whether you need hands or authority, and make the ask specific with the context and dead-ends included. Build a culture where reaching for help early is respected, not judged. The responders who look calm in a crisis are usually just the ones who got the right people in the room before it got out of hand.

AI-suggested hypotheses are advisory. Humans own the investigation, the decisions, and every action.

Related

• Designing Incident Escalation Policies That Actually Reach Someone
• The Incident Commander Role Explained for Engineering Teams
• Reducing MTTR: Where the Time Actually Goes and How to Cut It