A very quiet pager is good for sleep but bad for skill. Google's SRE book says every engineer should be on call at least once or twice a quarter to avoid knowledge gaps and confidence problems, and that fewer than one event per shift wastes on-call time. Keep skills alive with drills.
What the source says
In its discussion of burnout and underload, the on-call chapter notes that too little on-call exposure is also a risk. Engineers who rarely carry the pager lose familiarity with tools and procedures and lose confidence. The introduction adds that fewer than one event per shift wastes on-call time.
Why this hits security teams
Strong prevention can make incidents rare. That is the goal, yet it means the people who have handled a real compromise are few, and they may leave. The team then faces a real event with little practice.
Ways to keep skills sharp
- Rotate everyone through. The book's minimum of once or twice a quarter is a floor.
- Tabletop exercises. Walk through a scenario in a meeting room. Cheap and useful.
- Role play. The postmortem chapter describes Wheel of Misfortune sessions where a past incident is replayed.
- Game days. Safely trigger a planned detection in a test environment and see who notices.
- Read postmortems. Short reading sessions of old incidents, including from other teams.
Run a tabletop in one hour
- Pick a plausible scenario, such as a leaked credential used from an unusual place.
- Give the group a first fact and ask what they do.
- Add facts every five or ten minutes.
- Record gaps: missing access, unclear owners, stale runbooks.
- Assign fixes and review them next month.
Make quiet shifts useful
When the pager is silent, use the time to tune alerts, update runbooks, or automate a task. That converts unused capacity into reduced future load.
Balance with fairness
Rotating everyone in does not mean forcing it on people in a rough patch. Allow swaps and exemptions with a manager conversation.
Using quiet time well
A quiet period is a good moment to invest. Update the runbooks, test the contact list, rehearse a handoff, and check that everyone still has working access. Dead contact details and expired credentials are among the most common surprises in real incidents.
Ask each person to pick one improvement from the quiet shift and record it. The shift then produces something of value even when nothing happened, and the team keeps the habit of learning between events.
Quick check
How do we practise if nothing ever happens?
Use exercises. A tabletop and a replayed past incident give most of the benefit without any real risk.
Sources
Last reviewed: 19 October 2026.
