It’s 2:47 p.m. Your checkout service has been down for 11 minutes. Customers are screenshotting errors and calling in.

Your CEO walks into your office and starts asking questions.

In this moment, there are two kinds of IT leaders:

• Unprepared: Those who react (scrambling to assemble answers from Slack threads)
• Prepared: Those who answer quickly and confidently—with data

Whether you walk out with more budget authority (and executive trust) or less depends on your answers, and the infrastructure that supports them. But preparation isn’t just about surviving the incident. It’s actually a revenue opportunity.

In PagerDuty’s 2026 State of AI-First Operations Report, we found that 82% of revenue-growing organizations (we call them Revenue Risers) are investing in operational resilience.

Rather than just reacting faster, these teams are building stronger systems that provide a competitive advantage for the whole organization.

Here are the 13 questions executives ask after a major incident, and how IT leaders can build trust and organizational resilience by answering them confidently.

Phase 1: Immediate impact

The first wave of questions comes while the incident is still unfolding. The full picture isn’t clear yet, and the expected aftermath is almost completely unknown.

This is the most intense moment of executive scrutiny, and the one that sets the tone for everything after.

“What is happening?”

In the middle of a crisis, most engineers are focused on fixing the technical problem. But the CEO doesn’t want a stack trace. She wants a plain-language report of what’s broken, who it’s affecting, and what you’re doing about it.

Modern incident management platforms go beyond monitoring. They reduce noise and translate a flood of alerts into coherent reports, tailored to each stakeholder.

“How much revenue are we losing?”

This question can’t wait for a post-incident estimate three days later. But for many teams, it’s hard to answer while the problem is still ongoing.

Prepared organizations track business impact by quantifying the value of revenue-generating functionality (checkout, booking, and more) and modeling it live during an incident.

“What are customers saying?”

By the time the CEO asks, social media already has a narrative.

Revenue Risers monitor social channels and customer signals as part of incident response itself. PagerDuty closes the gap between customer complaints and engineering teams, so support stays updated on resolution time and marketing can intercept the brand narrative before it solidifies.

“When will this be resolved?”

The CEO needs something to tell both the customer support team and the board. But your answer needs to be more than a rough estimate.

Prepared teams have quick access to historical data from similar incidents to give realistic, data-backed ETRs and automatically update them as new information comes in.

“Who owns this?”

Executives want to know who is in charge of the resolution. They may be looking for someone to blame, but your job is to help them trust that the response is coordinated.

IT leaders should have clear service ownership mapped before the incident starts. With the right tools, SREs can be assigned to incidents and connected automatically (e.g. via Slack), while all stakeholders have easy access to progress updates without chasing them down.

Phase 2: Root cause and prevention

Even after the service is back online, the CEO is likely still fielding questions from the board and customers. This phase is less urgent but higher stakes for your long-term budget authority.

“What caused this?”

Executives want detailed root cause analysis or an assessment of known vulnerabilities. Ultimately, they’re looking for reassurance that you understand your own systems.

IT leaders need to know this answer long before anyone asks the question. AI-assisted diagnostics can surface likely root causes within minutes and automatically correlate incidents with recent deploys or configuration changes.

“What’s our story for this?”

Most CEOs don’t need the technical narrative—just something they can repeat to the board, customers, and the press.

Ideal incident response workflows use generative AI to draft stakeholder-ready summaries while the incident is still being resolved. But that only works if you can pinpoint the root cause precisely.

Post-incident reports should go further: benchmarking against industry standards and delivering separate narratives for executive leadership, customer support, and engineering.

“What are we doing to prevent this from happening again?”

Executives want assurance they won’t be caught off guard a second time.

Prepared IT leaders answer with a concrete, proactive prevention plan (not just faster reaction). Starting with root cause analysis, the right tools help you:

• Update specific workflows
• Identify systemic issues through pattern analysis
• Reduce operational toil

“If this happens again, can we fix it faster?”

CEOs want a plan for containing impact—even when you can’t prevent the next incident.

This could be a budget question in disguise. Come prepared with a clear root cause analysis, a list of obstacles, and a specific ROI pitch for reducing tooling debt and building more automation into the stack.

For example, Anaplan reduced incident resolution time by ~83% using PagerDuty’s AIOps platform to automatically filter out nearly 48,000 unnecessary alerts.

Phase 3: Organizational and strategic

In the weeks after the incident, the CEO starts asking bigger questions. Most of these are driven by board conversations, peer CEOs, and the sense that this incident exposed something worth fixing.

“How much time do we spend fixing issues like this?”

This question is concerned with efficiency and spending. How much time is going toward innovation versus putting out fires?

This is hard to answer without visibility into incident resolution time. Prepared teams will track engineering hours lost to toil and come prepared with a concrete plan to shift capacity toward higher-value work.

“Do we have the right tech stack for this?”

Translation: what tools do I need to buy to improve resilience?

Come prepared with:

• A post-incident tool audit
• A clear read on whether your stack is built for proactive or reactive response
• A pitch for closing the gap

“Can we use AI to help with this?”

Executives everywhere are under pressure to show progress on AI strategy. IT leaders should be ready to answer this question honestly.

Learn where agentic AI can autonomously resolve known issues and where generative AI accelerates human responders. But also be candid about where AI isn’t the right tool yet.

Are You Prepared for Another Incident?

Prepared IT leaders know the next major incident is coming. Rather than scrambling for data mid-incident, revenue-growing organizations are designing for resilience before it occurs.

But teams can’t do that with fragmented systems. That’s why well-prepared organizations (like TUI and AEO) have moved from a patchwork of point tools to a unified platform focused on operational resilience. Modern organizations need a tool that:

• Tracks (and translates) live business impact
• Maps service ownership and streamlines communication
• Automates fixes to well-understood incidents
• Frees your team to focus on what only humans can solve

That’s exactly what PagerDuty is designed to deliver.

Plus, with AI at the center, each incident makes the next response faster and more insightful than the last.

See how leading organizations are turning operational resilience into a competitive advantage. Read the PagerDuty 2026 State of Digital Operations Report.