Most major incidents showed visible signals weeks in advance.
The technical signs
Rising response times, CPU spikes without extra traffic, disk over 80% full.
The operational signs
Updates postponed for months, backups never tested, an SSL certificate expiring unexpectedly.
The good news: all of it is fixed with a regular maintenance plan.