Not demos. Real operations.

A CPU spike on api-gateway-prod causes latency to climb and pods to restart. L1 engineers spend 40+ minutes triaging across dashboards, logs, and traces before finding the cause. By then, the incident has escalated.

Checkout service reports intermittent latency spikes that don't show up clearly on any single dashboard. The issue is cross-service - cascading through 3 dependent microservices. Current tools produce noise; root cause is elusive.

A production database node silently fills disk over days. No alerts fire until 95% capacity, at which point the database freezes writes - causing a production outage. This pattern repeats quarterly across the infrastructure estate.

A Kubernetes service account is over-provisioned with cluster-admin rights during a rushed deployment. The misconfiguration persists undetected for weeks, exposing the cluster to potential privilege escalation. Audit reveals it 90 days later.

A user account experiences multiple failed logins followed by a successful one from an unusual geographic location. Standard tools generate a generic alert. No one investigates for 6 hours - far beyond the 2-hour breakout window for credential-based attacks.

A developer account uses sudo to gain root access on a production node outside approved change windows. The pattern matches known insider threat indicators. Without automated detection, this goes unnoticed until the next quarterly review.

A login occurs from an unknown foreign IP at 2 AM. Standard tools send an email alert - unread for hours. By the time a human responds, the attacker has had full access for 4+ hours and lateral movement may have occurred.

An SSH brute force campaign targets a production VM with 340 failed attempts in 12 minutes. The VM owner is offline. Firewall rules weren't set to auto-block. Lateral movement risk is real - and the window to contain is closing fast.

An engineer gains root access via sudo on a production system outside a change window - a known insider threat indicator. Without automation, this pattern goes unreviewed for weeks. The manager is never alerted in real time.

A finance team reports that their end-of-day reconciliation job failed silently. The batch process didn't trigger an alert. By the time the team notices, the downstream reporting pipeline is also corrupted - compounding the recovery effort.

A Helm chart update to the payments service introduces a breaking schema change that wasn't caught in staging. Error rates spike to 12% in production within 90 seconds of deploy. The on-call engineer is asleep. Every second of downtime counts.

A TLS certificate on the payments API expires silently. The first indication is a wave of user-facing errors and a browser security warning. The outage lasts 4 hours - damaging trust and triggering a post-incident review. This happens because certificate monitoring is manual and inconsistent.

The payment service's database connection pool reaches 100% utilization during a traffic spike. New requests begin queueing, then timing out. Within minutes, a cascading failure brings down 3 downstream services. L1 spends 45 minutes diagnosing before even opening a ticket.

Quarterly user access reviews are entirely manual - IT exports CSVs, managers reply by email, and the entire process takes 3 weeks. Stale accounts and orphaned permissions persist between reviews, creating compliance gaps that show up in audit reports.