If you deploy a change to your system, and things start to go wrong that same day, the prime suspect (no matter how unlikely it might seem) should be the change you made.

My first question when faced with an unknown error is "What was the last change and when was it promoted?"

This is an area where they are allowed to think yet another record setting DDoS attack first and bad config second.