> ## Documentation Index
> Fetch the complete documentation index at: https://docs.incident.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Measuring how incidents reach a diagnosis

> How we work out who first surfaced each diagnosis, and how quickly incidents reach one as a result.

[Accuracy](/investigations/measuring-accuracy) tells you whether an investigation's diagnosis was right. This page is about a different question: **how** each incident reached its diagnosis, and who actually surfaced the information that explained it, whether the investigation, your responders, or a mix of both. Alongside that we measure **time to diagnose**, so you can see how quickly incidents reach a diagnosis depending on who drove them there.

Both appear on the [Investigations page](https://app.incident.io/~/investigations) in your dashboard, under **How it was diagnosed**.

## How we work out who diagnosed it

Once responders establish an incident's cause, we look back over everything that happened before the cause was understood (channel messages, incident calls, and the investigation's own findings) and reconstruct the **diagnostic chain**: the small number of steps that were genuinely key to reaching the answer. Exploration that didn't pan out doesn't count, and neither does anything after the diagnosis. Confirmation and remediation are important work, but they aren't diagnosis.

Each step is attributed to whoever **first surfaced** it. Attribution comes from the evidence behind the step: the message, call moment, or investigation finding that delivered the result. If a step's results arrived in an investigation finding, the step is the investigation's; if they arrived in a responder's message, it's the responders'; a genuine collaboration counts toward both.

The balance of steps places each incident in one of four bands:

| Band                      | What it means                                                                                           |
| ------------------------- | ------------------------------------------------------------------------------------------------------- |
| **Autonomous**            | Investigations reached the correct diagnosis independent of responder input.                            |
| **Led by Investigations** | The incident was diagnosed mainly by Investigations, with a small amount of assistance from responders. |
| **Led by responders**     | The incident was diagnosed mainly by responders, with a small amount of assistance from Investigations. |
| **Manual**                | Responders reached the correct diagnosis independent of Investigations input.                           |

Between the two extremes, the band goes to whichever side drove the majority of the steps. On a dead-even split, it goes to whoever surfaced the first load-bearing clue.

### An example

Here's how an example incident breaks down:

<Steps>
  <Step title="The investigation isolates the failing dependency">
    Checkout starts returning 500s. Within a minute, the investigation traces the errors to a single downstream (the
    payments service) and posts a heads-up. First diagnostic step, attributed to Investigations.
  </Step>

  <Step title="The investigation recovers the underlying error">
    It pulls the payments service's logs and surfaces a spike of database connection-pool timeouts that lines up with
    the error rate. Second step, again the investigation's: it recovered the evidence that mattered.
  </Step>

  <Step title="Diagnosed: a responder connects it to a config change">
    A responder recognizes that the timeouts began right after a deploy that cut the connection-pool size, and names
    that as the cause. This is the moment the cause is understood, so it ends the diagnostic chain and stops the
    time-to-diagnose clock. As the step that named the cause, it's the responder's step.
  </Step>

  <Step title="Fixed">
    Responders restore the pool size. The fix comes after the diagnosis, so it doesn't affect which band the incident
    lands in, or its time to diagnose.
  </Step>
</Steps>

Three steps in all, two of them the investigation's, so this incident lands in **Led by Investigations**: the band
follows who did the majority of the diagnostic work, not who spoke the final diagnosis.

Note that credit goes to whoever surfaced each piece of the answer first, regardless of what happened next. If an investigation names the root cause in its hypothesis but responders investigate independently and arrive at the same answer themselves, the credit is still the investigation's: it found the answer first, even though its version wasn't the one responders acted on. That's why we frame this around who *diagnosed* the incident rather than who *fixed* it: it measures who found the answer, not whose work resolved the incident.

<Info>
  Because this breakdown credits whoever surfaced each finding first, it deliberately doesn't tell you how much of an
  investigation's content responders actually used. That's what [engagement](/investigations/measuring-engagement)
  measures: whether responders read, steered, and acted on what an investigation surfaced. Read the two together: an
  investigation can drive the diagnosis and still see little engagement, or see heavy engagement without leading the
  diagnosis.
</Info>

## Time to diagnose

For each incident that reached a diagnosis, we measure the time from the **start of the investigation** to the **moment the cause was first understood**: the specific message or call moment where the answer landed, located after the fact from the incident's own record. The dashboard shows the **median** time to diagnose for each band, so you can compare how quickly incidents reach a diagnosis depending on who drove them there.

We also calculate how much faster incidents are diagnosed when Investigations drove the diagnosis: the median time to diagnose for incidents in the **Autonomous** and **Led by Investigations** bands, compared against the median for the rest (**Led by responders** and **Manual**).

## Where you see it

The breakdown appears on the Investigations page in your dashboard, once around ten investigations in the selected period have reached a diagnosis we can attribute. The percentages are shares of those diagnosed, attributable incidents. An incident whose cause was never established, or whose diagnostic steps couldn't be attributed to either side, isn't part of the split.

## FAQs

<AccordionGroup>
  <Accordion title="Why isn't every incident shown in the breakdown?">
    The breakdown needs a diagnosis to work back from. If an incident's cause was never established, or we couldn't
    locate the moment it was understood, there's no diagnostic chain to attribute and the incident sits out of it.
  </Accordion>

  <Accordion title="What if responders re-did work the investigation had already done?">
    Credit stays with whoever surfaced it first. It measures who found the answer, not whose version of the answer
    responders acted on, so an investigation that named the cause early keeps the credit even if responders
    independently re-derived it later.
  </Accordion>

  <Accordion title="Does Autonomous mean nobody was involved?">
    It means the diagnostic steps all came from Investigations independently of the responders. Responders were still
    there confirming the diagnosis, fixing the incident, but the work of finding the answer didn't depend on them.
  </Accordion>

  <Accordion title="Does Manual mean Investigations didn't run?">
    No. Investigations still ran. Manual just means none of its work fed the diagnosis: every key step came from
    responders, so even where the investigation surfaced findings, none of them turned out to be part of the chain that
    reached the cause.
  </Accordion>

  <Accordion title="How are steps split when both sides worked together?">
    A step whose result was genuinely a collaboration counts toward both sides. And when an incident splits exactly
    evenly, the band goes to whoever surfaced the first load-bearing clue.
  </Accordion>

  <Accordion title="Does a faster time to diagnose for Investigations-driven incidents prove they'd speed up every incident?">
    No. It's a comparison across different incidents, not the same incident with and without an investigation. And the
    incidents Investigations can drive tend to be the more tractable ones. Treat the gap as a useful signal, not a
    controlled experiment.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="Measuring accuracy" icon="bullseye" href="/investigations/measuring-accuracy">
    How we grade investigations against what really caused your incidents.
  </Card>

  <Card title="How investigations work" icon="magnifying-glass" href="/investigations/how-investigations-work">
    The process behind a result, and how an investigation builds conviction in real time.
  </Card>

  <Card title="Incident channel experience" icon="message" href="/investigations/incident-channel-experience">
    How investigations show up for responders while an incident is live.
  </Card>

  <Card title="Trust and safety" icon="shield" href="/investigations/trust-and-safety">
    How investigations stay under your control, auditable, and honest about what they know.
  </Card>
</CardGroup>