Abby Wambach, Neil Peart, Kelsey Hightower. These people are all experts in their relevant fields. Through them we recognize expertise as an exceptionally high level of performance on a particular task or within a given domain. The universal inputs to their expertise are time and exposure (aka practice). Expertise in any domain is acquired through doing, and more specifically by continued exposure to varying conditions and inputs inherent to the given domain. The latter part is important: while someone can absolutely become an expert in a very narrow sense (e.g. solving Rubik’s cubes), and someone can also learn about a subject or domain by reading, talking, listening, watching podcasts, etc., high-performance domains exert unpredictable, variable, and dynamic demands on the expert that are only mastered by continued exposure and deliberate practice within that domain.

”Experts are the people the team turns to when faced with difficult tasks.”

—Gary Klein

I have recently been on a number of podcasts/webinars/panels where the question of what expert incident response looks like comes up, especially how to train for and formalize it. Lurking behind that question for some people is often the hope that in the answer lies the opportunity to productize, scale, and even automate this essential skill for modern software-based businesses. We are currently awash in AI Ops and AI SRE solutions attempting to do just this, and I’m here to convince you that expertise cannot be bottled and sold. Beyond that, I hope to persuade you that expertise is worth investing in and cultivating within your own organization.

Common Characteristics of Expertise

It is worth noting that expertise is not simply the accrual of experience over time. As hinted at in the earlier quote from Gary Klein, expertise is a specific kind of knowledge, and it shares a number of things in common.

Expertise Is Often Invisible

Cognitive scientists and folks in the field of Resilience Engineering refer to this as the Law of Fluency. This fluency characterizes an activity that is well-adapted, such that the effort and challenges involved in conducting that work are hidden from view, making it appear smooth and effortless. Experts adapt to complex and surprising situations by filling gaps and managing challenges effectively and efficiently, and notably in ways that may not be apparent to other people. In general, fluency is considered a hallmark characteristic of expertise.

Expertise Is Not Easily Introspected

In general, experts do not have direct access to the cognitive, physical, and other sources of their expertise—human performance, given the way it is acquired through experience over time, is inherently difficult to explain. This is why many people refer to this kind of skill as implicit, or subconscious. Answering the question “How did you know to do X?” for an expert often leads to a long exploration of “Well, it reminded me of this one time…” or “It seemed similar to when…” In asking someone to explain their expertise, we are effectively asking them to try to unearth every second of practice and effort they have put into acquiring their skill.

Expertise Enables Adaptation

People newer to a skill or domain typically rely on documentation and more rigid and rule-based methods for performing a given task. They lack the context and experience to handle variations from standard expectations and outcomes, and tend not to experiment or improvise as much. Experts, on the other hand, demonstrate a unique ability to adapt to novel information, challenges, and surprise situations. Given the breadth and depth of their experience (and having learned by trying many various approaches and strategies over time), they are better equipped (and generally, more confident) to stretch and adjust when presented with novel situations. Think of this as the difference between being able to read sheet music well and being able to play jazz with a group you just met. 

Consider the following list of characteristics of expertise that Gary Klein and a number of other cognitive scientists have empirically demonstrated. They found that experts:

• Employ more effective strategies than others, and do so with less effort;

• perceive meaning in patterns that others do not notice;

• form rich mental models of situations to support sensemaking and anticipatory thinking;

• have extensive and highly organized domain knowledge; and

• are intrinsically motivated to work on hard problems that stretch their capabilities.

If that sounds like some of the fundamental aspects of resilience, you’re on the right track. 

Expertise Is a Key Ingredient for Resilience

Given the above characteristics of expertise and how they develop, expertise can’t simply be “bottled” and subsequently scaled or reproduced en masse. As noted above, most high-performance domains are extremely variable, so one element of maintaining expertise is constantly updating mental models and factoring in new variables, challenges, and developments. Layer the nature of modern distributed software systems on top of this, and you begin to see that one cannot simply capture expert incident response and productize it.

Someone is inevitably going to say “Well we’ll just train our LLMs and agentic models on all the conditions necessary to generate expertise in incident response and then we can have that, right?” As they currently stand, LLMs and AI agents do not acquire expertise the way humans do, in part because they require human model development, training, and refinement. They also are not capable of sensemaking, reflection, coordination across fuzzy boundaries, reciprocity, vicarious learning from others’ experiences, observational learning (picking up things “in the air” from casual discussions), or “seeing the invisible” (perceiving missing vs. present cues)—these are all but a subset of the kinds of cognitive processes involved in developing and maintaining expertise that have been studied for decades by cognitive scientists. 

AI SRE agents can currently survey a given system’s environment and find inputs and patterns to generate hypotheses about how a given situation may have arisen. They can do this over and over and over, but they do not possess the knowledge or ability to, for example, call Sarah on the database team and see if she knows why things look weird. They can’t factor in the architectural discussions the team had about the recent migration which might explain why things aren’t behaving as expected. They can't notice that the system is behaving exactly like it did six months ago before a cascading failure, because that pattern lives in someone's memory, not in a log file. They can't pick up on the fact that the on-call engineer sounds unusually uncertain on the incident call, or that the team has gone quiet in a way that usually signals something is badly wrong. These aren’t edge cases, they are routine features of how complex incidents actually unfold.

The prevailing belief in the software industry appears to be that we can use automation and AI to replace what expertise has given us in the past. However, consider the data from the 2024 VOID report, wherein 75% of incidents involving automation required human intervention to comprehend, troubleshoot, and resolve the incident. That is where experts quite often save the day. Here we contend with the ouroboros of expertise and automation, in which experts don’t have as much experience with the system at hand, and then when asked to step in and resolve a problem with said system, they have found their expertise eroded by having less direct access to how it actually functions. 

A lack of experience with systems due to increased automation and AI can lead to de-skilling of experts, by depriving them of the continued exposure to the complexities of the systems they are expected to understand as experts. Remember: expertise is accumulated through repeated exposure to a wide variety of situations over time. As we add more automation and AI to these systems, it becomes even more difficult for people to build expertise with those systems, much less to be able to introspect how automation and AI are impacting the functioning of these systems. 

So what can organizations actually do to cultivate and protect the expertise that their resilience depends on?

Three Things Organizations Can Do to Foster Expertise

1. Develop and feed a culture where expertise is given the time and space it needs to develop and thrive. This means resisting the pressure to automate away the messy, variable, difficult work that builds expertise in the first place. It means recognizing that the engineer who has been in the weeds with a system for three years is an organizational asset, not just a headcount.

2. Invest in building the skills required to do effective incident analysis. Post-incident reviews done well are one of the most powerful tools organizations have for surfacing, sharing, and building expertise. Not the checkbox RCA that documents what went wrong and assigns blame, but the rich, narrative, learning-focused review that asks how the system actually behaved and how your experts made sense of it under pressure. This is where tacit knowledge gets made visible.

3. Help your experts identify and share the strategies and patterns they use. Incident analysis will help surface these, but the work doesn't stop there. Your organization needs specific approaches like knowledge elicitation, narrative storytelling, and communities of practice for distilling what your experts know into something the broader team can learn from. 

The vendors selling AI SRE and AI Ops solutions aren't necessarily wrong that these tools can help during incident response—they can survey environments, find patterns, and generate hypotheses faster than any human. But they are focused on a different problem than ensuring whether your systems are resilient. Resilience is continuously created by the people who have spent years inside your systems, who know what normal feels like, who remember what happened last time things looked like this. That expertise took time to build, and  it can't be purchased off the shelf. The good news is that it can be cultivated, incentivized, and shared. Expertise is contagious when organizations create the conditions for it to spread.

References

Peak: Secrets From the New Science of Expertise (Ericsson & Pool 2016) 

Seeing What Others Don't: The Remarkable Ways We Gain Insights (Gary Klein, 2015)

The Cambridge Handbook of Expertise and Expert Performance (Ericsson et al, 2006)

Why Expertise Matters: A Response to the Challenges (Klein et al., 2017)

The Ironies of Automation (Bainbridge, 1983)

Courtney Nash

Vice President, RISF