Not demos. Real operations.

A CPU spike on api-gateway-prod causes latency to climb and pods to restart. L1 engineers spend 40+ minutes triaging across dashboards, logs, and traces before finding the cause. By then, the incident has escalated.

Checkout service reports intermittent latency spikes that don't show up clearly on any single dashboard. The issue is cross-service - cascading through 3 dependent microservices. Current tools produce noise; root cause is elusive.

A production database node silently fills disk over days. No alerts fire until 95% capacity, at which point the database freezes writes - causing a production outage. This pattern repeats quarterly across the infrastructure estate.

An infrastructure service account is over-provisioned with admin rights during a rushed deployment. The misconfiguration persists undetected for weeks, exposing the environment to potential privilege escalation. Audit reveals it much later.

A user account experiences multiple failed logins followed by a successful one from an unusual geographic location. Standard tools generate a generic alert. No one investigates for 6 hours - far beyond the 2-hour breakout window for credential-based attacks.

A developer account uses sudo to gain root access on a production node outside approved change windows. The pattern matches known insider threat indicators. Without automated detection, this goes unnoticed until the next quarterly review.

A login occurs from an unknown foreign IP at 2 AM. Standard tools send an email alert - unread for hours. By the time a human responds, the attacker has had full access for 4+ hours and lateral movement may have occurred.

An SSH brute force campaign targets a production VM with 340 failed attempts in 12 minutes. The VM owner is offline. Firewall rules weren't set to auto-block. Lateral movement risk is real - and the window to contain is closing fast.

An engineer gains root access via sudo on a production system outside a change window - a known insider threat indicator. Without automation, this pattern goes unreviewed for weeks. The manager is never alerted in real time.

A finance team reports that their end-of-day reconciliation job failed silently. The batch process didn't trigger an alert. By the time the team notices, the downstream reporting pipeline is also corrupted - compounding the recovery effort.

A Helm chart update to the payments service introduces a breaking schema change that wasn't caught in staging. Error rates spike to 12% in production within 90 seconds of deploy. The on-call engineer is asleep. Every second of downtime counts.

A TLS certificate on the payments API expires silently. The first indication is a wave of user-facing errors and a browser security warning. The outage lasts 4 hours - damaging trust and triggering a post-incident review. This happens because certificate monitoring is manual and inconsistent.

The payment service's database connection pool reaches 100% utilization during a traffic spike. New requests begin queueing, then timing out. Within minutes, a cascading failure brings down 3 downstream services. L1 spends the better part of an hour diagnosing before even opening a ticket.

Quarterly user access reviews are entirely manual - IT exports CSVs, managers reply by email, and the entire process takes 3 weeks. Stale accounts and orphaned permissions persist between reviews, creating compliance gaps that show up in audit reports.

Sales tickets pile up because quote approvals stall, CPQ rules misprice, or contracts fail to sync downstream. Each failure spans Salesforce, CPQ engine and ERP - and the L1 ticket reads "Quote not generating" with zero context.

CAB members spend most of every meeting reading ticket descriptions. Risk scoring is inconsistent. Standard changes get over-scrutinised; risky changes slip through because nobody had time to read the implementation plan.

A HIRE event lands in HR. The new joiner needs Active Directory, email, SAP role, ServiceNow access, laptop request, and ten SaaS apps. Manually orchestrated, this takes 2-5 days and ends in a Day-1 ticket from the joiner saying "I can't log in."

SLA breaches usually announce themselves the moment they happen - not before. By then the only options are escalation, customer apology, and a service credit. The signals that predict a breach are sitting in the ticket history; no one reads them.

Problem records are supposed to find the systemic root cause behind recurring incidents. In practice they get created late, with thin evidence, by someone who happened to spot the pattern. Most recurring causes never become a problem record at all.

A production model's accuracy quietly degrades as live input data drifts away from its training distribution. Nothing alerts, because the pipeline is green. Wrong predictions flow downstream until someone notices in the next review.

A critical vulnerability is disclosed in a dependency hours before a scheduled release. The build already passed because the security scan runs nightly, not on this commit. The team is about to ship a known-vulnerable artifact.

A nightly reconciliation batch fails on a managed estate. The L1 ticket reads "job failed" with no sense of what it feeds. No one can tell whether it is cosmetic or about to breach a customer SLA, so everything gets escalated to be safe.