His silence during a live security incident is not a message about you. When a breach is active, a cybersecurity professional drops into a mode where every hour is triage and the outside world stops existing, and that blackout can run a day or several. Read the severity of the incident, not the temperature of the relationship, and you will know exactly what to expect and what to send.

I can tell you what is happening inside his head because I live a version of it.

I run five businesses. When one of them catches fire at 11 p.m., I go quiet in a way that has nothing to do with the person waiting on the other end of my phone. I am not weighing them against the crisis. The crisis has simply eaten the part of my brain that would have replied. A cybersecurity professional in the middle of an incident is that, turned up to its most extreme setting, because his fire is measured in stolen data and clocks that do not stop.

So let me show you how to read it instead of drowning in it.

Why he goes dark when the pager goes off

An incident is not a busy day. It is a different physical state.

A normal workday has gaps. He steps out for coffee, glances at his phone, sends you a line between meetings. An incident removes the gaps. The moment an intrusion is confirmed or systems go down, he is in a war room, real or virtual, watching logs move and making decisions where a slow reply costs money and trust. This is baked into the job itself. The U.S. Bureau of Labor Statistics notes that information security analysts sometimes have to be on call outside of normal business hours in case of an emergency, and that some regularly work more than forty hours a week. The pager is not a metaphor. It is the structure of his week.

Here is the part most guides miss. His going dark is not avoidance dressed up as work. When it is a real incident, the silence has a shape. It starts when the alert fires. It has a rough end when the threat is contained. And it comes with a debrief on the other side, because he will surface exhausted and slightly wired and want to tell you what he just survived.

Avoidance has no shape. That distinction is the whole game, and the protocol below is how you read it.

The Severity-Based Contact Protocol

His job already sorts every alert into severity tiers. You are going to borrow the same system.

The Severity-Based Contact Protocol is simple. Instead of setting your expectations by your anxiety, you set them by the incident's severity level, the same way his team does. You ask for a severity read once, early. Then you match your contact to the tier he names instead of to the story your mind is writing at midnight. One question replaces a hundred spiraling guesses. That is the entire mechanism, and it works because it moves you off feelings and onto the one fact that actually governs his availability.

There are three tiers you need to recognize.

Critical: the active breach

This is the top tier. Ransomware detonating, an attacker inside the network, customer data exposed, production systems down. When he says it is critical, believe him and go quiet on your end. Contact drops to near zero, and it can stay there for a day or several. This is not the moment for a relationship conversation, a status check, or a test of how much he cares. He is holding a fire hose. Your job is to not stand in front of it.

Serious: contained but hot

The threat is understood and boxed in, but the cleanup is heavy. He is doing forensics, patching, writing the report leadership is demanding by morning. He can send you a one-line message. He cannot have a conversation. Expect short, flat, delayed replies and do not read the flatness as coldness. A man doing incident cleanup at hour fourteen is not being distant with you. He is running on fumes.

Elevated: on call, no fire yet

No active incident, but he is the person who gets woken up if one starts. He is present but braced. He might cancel a plan on ten minutes' notice, sleep with his phone on loud, or check his laptop during dinner. This tier is the normal texture of his life, not a crisis. If elevated feels like a crisis to you every time, the issue may be fit rather than any single incident, and that is worth naming honestly.

Ask him which tier he is in. Let his answer, not your fear, set the next few days.

What to text him mid-incident

Do not send a string of "are you ok" messages. Do not go silent to see if he notices. Both moves make him manage your feelings while he is managing a breach, and both teach him that your contact is a cost during his worst hours instead of a relief.

Send one message that reduces his load and then stop.

Saw you're heads down on something serious. I'm good, not sitting here worried, so don't add me to your list. Ping me whenever you surface and I'll be here. Go handle it.

That message does three things at once. It tells him you understand the tier. It removes you from the pile of things he has to worry about. And it gives him a route back with no deadline attached, so returning to you feels like relief instead of a second incident. He can read it in four seconds and put the phone back down.

If you need one practical thing from him, ask for a single fact, not reassurance. "Roughly how long, so I know whether to make other plans for the weekend?" is answerable in one word. "Do you still care about me?" is not, and asking it now will cost you more than the silence did.

The debrief after the incident closes

The incident ending is not the same as him being back.

When a critical incident finally closes, he does not walk out fresh. He walks out depleted. The CDC's occupational safety institute documents that long work hours and off-schedule work increase fatigue and stress and cut into the time and energy people have for family and non-work life. Translated to your relationship, that means the man who surfaces after three days of crisis is not at full capacity for another day or two. His tank is empty. Recovery is part of the incident, even though it does not look like work.

This is where the Bandwidth Mirror matters. You mirror your output to the bandwidth he actually has, not the bandwidth you wish he had. Right after a big incident, that means a low-demand landing. Food, sleep, a quiet evening, a walk. Not the summit conversation about where the relationship is going. Save that for when he has slept and eaten and the color is back in his face. Push it into the exhaustion and you will get a version of him that cannot show up for it, then you will both mistake bad timing for a bad relationship.

Watch what he does with the debrief window. A man who is genuinely in this with you will want to tell you about the incident once he is human again. The story, the near-miss, the stupid thing that caused it. If he consistently closes incidents and reconnects, the pattern is healthy even when the crunch weeks are hard. If incidents close and he stays gone, that is a different signal, and the read on whether a busy man pulls away when stressed picks up there.

When "always on an incident" is really avoidance

Now the uncomfortable part. Sometimes the incident is real. Sometimes the incident is a permanent weather system.

Because I run the operation I run, my team has thousands of conversations with men every week, and I watch this exact move play out constantly. A demanding job becomes a shield. "I'm slammed" becomes the answer to everything, including questions that have nothing to do with work. The tell is not how busy he says he is. The tell is shape. A real incident has a start, a severity, an end, and a debrief. Avoidance has none of those. It is a fog with no edges, no answer to "how long," and no reconnection when it supposedly clears.

Run the check across a few cycles. When you ask for a severity read, does he give you a specific answer or a vague one? When the incident ends, does he come back, or does the next fog roll in right on schedule? Does he ever protect a plan in advance, or is everything canceled last minute under the same explanation? A man in a genuinely intense field will still find ways to signal that you matter between fires. If every window closes with the same word and nothing is ever safe, you are not dating a man in an incident. You are dating a man who has found a permanent excuse, and that is the same structural problem the guide on dating a corporate lawyer during a deal and dating a trial lawyer during a case both circle from their own angles.

How to read the pattern over a few cycles

You are not going to decide anything from one incident. You are going to read the rhythm.

By the third or fourth cycle you will have a filter. You will know his tiers. You will know how long a real critical event takes him, how he texts when he is buried, whether he debriefs, and whether he protects your time when there is no fire. That filter tells you the thing that actually matters, which is not whether he is busy. Every man worth dating in this field is busy. It is whether the busyness has edges you can plan around and a person on the other side of it who comes back to you when the smoke clears.

If the incidents keep their shape and he keeps returning, you are dating a capable man with a hard job, and the same skills that help with any demanding partner apply. Start with the hub on dating an entrepreneur for the wider playbook, and use the guide on a relationship during a major work deadline for the crunch weeks specifically.

You do not need to understand firewalls to date this man. You need to read severity instead of silence, land him softly when the fire is out, and notice whether the fog ever lifts.

That is a read you can run on any incident, anytime, without ever asking him to prove he cares.