To build a matrix, you need two axes. Most organizations use Reach (who is affected) and Impact (how broken is the experience for those affected). Every incident can be plotted on these two axes, and their intersection determines the severity.
Dimension 1: Reach (Who Is Affected?)
Reach measures the blast radius — the fraction of your user base experiencing the problem.
- Global: All users, all regions, all customer tiers.
- Regional: A specific geography (e.g., "EU-West" or "US-East-1").
- Segment: A specific feature set, user tier, or customer cohort (e.g., "Free Tier users" or "users on the mobile app").
- Single: One specific customer or account.
Reach is usually measurable from your observability stack. If your error rate dashboard shows 80% of requests failing, that is a global reach. If your regional latency graph shows elevated p99 only in ap-southeast-1, that is a regional reach.
Dimension 2: Impact (How Broken Is It?)
Impact measures the functional or financial damage to the affected users.
- Data Loss or Breach: User data has been corrupted, deleted, or exposed. This is categorically the worst impact because it cannot be undone.
- Total Unavailability: The feature or service is completely non-functional. Error rate is near 100%. Users cannot proceed at all.
- Core Feature Degraded: The primary function works, but is slow, unreliable, or partially broken. Users can sometimes complete their task.
- Non-Core Feature Broken: A secondary or supporting feature is broken, but the primary workflow is unaffected.
- Cosmetic Issue: The interface looks wrong, but all functionality works correctly.
The Matrix Logic
You combine the two dimensions to find the severity. The logic is intuitive once you internalize it:
- Global reach + Data Breach = SEV0 — Company survival is at risk.
- Global reach + Total Unavailability = SEV1 — Revenue is being destroyed right now.
- Single customer + Total Unavailability = SEV3 — Serious for them, contained for you.
- Global reach + Cosmetic Issue = SEV4 — Annoying, but not urgent.
Key Point: Severity is the intersection of reach and impact. Neither dimension alone is sufficient — a total outage affecting one internal test account is not a SEV1, and a cosmetic bug affecting all users is not a SEV1 either.