Null hypothesis of an outage

The working assumption at the start of an incident that the cause is the most recent change. It is right often enough to be the first thing checked and the first thing ruled out, and it is what makes a deploy timeline the most valuable dashboard in an incident. The failure mode is stopping there: once the recent change is excluded, people tend to reach for exotic explanations before checking the second-most-recent one.