The day 8.5 million screens went blue, and the people who fixed it

The fix took 78 minutes. The recovery took 10 days.

On the morning of 19 July 2024, CrowdStrike pushed a routine content update to its Falcon security software. Channel File 291 told the sensor to expect 21 input fields; the code supplied 20. Reading the missing field caused an out-of-bounds memory error inside the Windows kernel, and every machine that received the update crashed to a blue screen and kept crashing on every reboot. In 78 minutes CrowdStrike reverted the update, but by then roughly 8.5 million Windows machines were already down, by Microsoft's own count, in what is widely called the largest IT outage in history.

Here is the part that matters for this article: reverting the code did not bring a single machine back. Each one had to be booted into safe mode by hand, often behind BitLocker encryption that demanded recovery keys, so IT teams walked machine to machine with USB sticks while Microsoft shipped a special recovery tool and deployed hundreds of engineers. Delta cancelled about 7,000 flights over five days and later sued CrowdStrike for $500 million. In India, Delhi airport switched to manual check-ins and IndiGo agents handed out handwritten boarding passes, a photo of which went around the world. Banks, hospitals and broadcasters queued behind them. Fortune 500 companies alone lost an estimated $5.4 billion, and only 10 to 20 percent of it was insured.

What incident management actually is

ITIL 4, the framework taught in every service operations curriculum, defines an incident as an unplanned interruption to a service or a reduction in its quality, and the practice's purpose as minimising the negative impact by restoring normal service as fast as possible. The process is a disciplined loop:

Priority comes from impact multiplied by urgency, which is why a payment gateway going dark is a P1 that wakes people up, while a broken printer is a P4 ticket. Two numbers rule the discipline: MTTA, the mean time to acknowledge an alert, and MTTR, the mean time to resolve it. When an incident is big enough to threaten the business, it becomes a major incident and a war room forms with clearly separated roles, a structure popularised by PagerDuty's incident response framework:

Three more nights the internet broke

The blue screen day was not a one-off. In the twelve months that followed, three of the world's most sophisticated engineering organisations went down, and each published an honest postmortem worth reading.

Notice the pattern. In all four incidents, including CrowdStrike's, the technology failed in minutes and the organised human response, triage, war room, communication, staged recovery, postmortem, is what determined whether the outage cost thousands or billions. Uptime Institute's 2026 outage analysis found that 57 percent of significant outages now cost over $100,000, one in five crosses a million dollars, and human error, usually failure to follow procedure, remains a leading driver. Procedure is precisely what incident managers own.

The career, and what it pays in India

Every bank, airline, hospital chain and GCC in India runs a 24x7 service operations desk, and the tooling standard is ServiceNow, a long-running Leader in Gartner's ITSM rankings. At the time of writing, Naukri lists over 22,900 ITSM roles, around 6,600 major incident management roles and about 7,400 ServiceNow roles, with Bengaluru alone showing thousands of incident management openings on Glassdoor.

Pay scales with pressure, and all figures here are self-reported ranges. Glassdoor puts the average incident manager around ₹6 lakh with a typical band of ₹5 to 10 lakh across 754 reports; PayScale's range runs from about ₹3.5 lakh at entry to ₹10 lakh at the 90th percentile. Step up to major incident manager, the person who commands P1 war rooms, and Glassdoor's average rises to about ₹8.4 lakh, with 10 to 14 years of experience reporting around ₹21 lakh and 15 plus years ₹23 to 27 lakh. The role rewards exactly the skills the case studies above demand: calm under pressure, structured communication and process discipline, not raw coding ability.

Will AI take this job?

The honest answer from the field: AI is joining the war room, not running it. AIOps tooling now clusters alerts, cuts noise and speeds up triage, and that is genuinely useful, because outage complexity is rising, with cloud and third-party providers accounting for around two thirds of publicly reported outages in Uptime Institute's long-run tracking. But look at the 2025 postmortems again: it was automation itself that failed at AWS, and recovery began when humans took command of it. As long as businesses lose five figures a minute when systems fall over, someone accountable will be standing in the middle of the room making decisions. The job is becoming more leveraged, not less needed.

Questions people actually ask