Between “the system detected something” and “someone did something about it” sits a decision that most security programs never write down: who gets told, how fast, and with what authority to act. Get it wrong in one direction and a 2 a.m. detection waits politely in a queue until Monday; wrong in the other and every false positive pages the owner at dawn until everyone stops answering. Escalation design is the unglamorous connective tissue between detection tooling and incident response — and it’s a one-page document. Here’s what goes on it.

Severity tiers: pre-deciding the urgency argument

The core of the page is a small table mapping what was detected to how fast humans engage — decided on a calm day so nobody’s debating urgency mid-incident. A workable small-business version:

  • Critical — active harm in progress: ransomware behavior, confirmed account takeover, data leaving, an attacker demonstrably live. Response: immediate containment (see authority, below) and a human phone call — not a ticket, not an email — to the named contact, at any hour. Minutes matter; the whole 24/7 argument lives in this row.
  • High — probable compromise, not yet detonating: credential theft indicators, a suspicious sign-in that fits the intrusion pattern, malware caught but with signs it ran first. Response: contained and investigated now, business notified by the agreed channel, worked to resolution same-day.
  • Medium — caught and blocked, worth understanding: the quarantined attachment, the phishing campaign that got reported, the blocked malicious site. Response: next-business-day review, watching for patterns (five employees receiving the same lure is a campaign, which promotes it a tier).
  • Low — hygiene and telemetry: the policy violations, the noise worth counting. Response: logged, trended in the monthly reporting, never paged.

The tiers do their real work at the boundaries — so the table needs examples, and one promotion rule: uncertainty rounds up. An analyst unsure whether something is High or Medium treats it as High; the cost asymmetry between over- and under-escalating is the entire philosophy.

The authority line: what happens before anyone answers

The severity table decides who’s told; the authority line decides what’s already been done by then — and it’s the decision that most changes outcomes. For each response actor (the MDR SOC, your provider’s on-call, internal IT), write down what they may do autonomously: isolate workstations on high-confidence detections — yes, always (a wrongly isolated laptop costs an apology; a politely un-isolated ransomware host costs the company) · disable a compromised user account — yes · isolate a production server or cut internet at the firewall — call first, because that’s a downtime decision with a dollar value that belongs to the named decision-maker in the IR plan, unless harm is actively spreading, in which case act-then-call. Writing this down is what converts “24/7 monitoring” into 24/7 response — it’s the second question in any MDR evaluation, and the answer should exist on paper before the first alert, including yours.

The contact path: tested, layered, boring

Critical escalations fail on logistics more than judgment, so the page ends with the mechanics: named humans with backups — a primary, a secondary, and a tertiary for each business role, phone numbers verified quarterly (the number that changed is the classic failure) · channel matched to severity — Critical is a voice call that repeats until answered; High can be the agreed alert channel with an acknowledgment expectation; anything that can wait for email is a Medium · acknowledgment loops — an unacknowledged Critical page escalates to the next name automatically, because “we notified them” and “they know” are different claims · and one drill a year: a simulated Critical, off-hours, timing the chain from alert to human voice to decision. Like every drill, the finding is the product — and there’s always a finding.

The bottom line

Escalation is where detection either becomes response or becomes a Monday surprise, and it’s governed by one page: severity tiers with examples, autonomous-action boundaries drawn in advance, and a contact chain that’s been dialed for real at least once. Write it with whoever watches your alerts, staple it to the incident plan, and the 2 a.m. question — who do we wake, and what have we already done? — gets the only good answer: it was decided years ago, on a Tuesday, by people who were fully awake.