How do maturity stages 1 (Initial) and 2 (Monitoring) differ, and what is each one still unable to do?

Stage 1 is firefighting — no standardised monitoring, problems reported by users, logs read by hand. Stage 2 adds dashboards, infrastructure metrics and thresholds, so known problems are caught early — but only the ones somebody anticipated.

Stage 1 — Initial. Barely any standardised monitoring; problems arrive via users; logs are searched manually; no end-to-end view. Its characteristic sentences are "the customer says the system is slow" and "we don't know when the problem started" — the second one is the more damaging, because without a start time there is no way to correlate the problem with a change. The consequences are long outages, high operational effort and low transparency.

Stage 2 — Monitoring. Dashboards exist, infrastructure metrics are collected, thresholds and alerts are defined: CPU above 80%, memory low, service unreachable. The gain is real — first transparency, and faster detection of known problems.

The limitation is equally real: the focus is on known failure cases. Everything the team thought of has a check; everything else is invisible. That is precisely the boundary stage 3 crosses, and it is why "we have monitoring" is not the same claim as "we can diagnose our system".