Incident severity can change as facts emerge

The severity you assign in the first hour is a guess made with almost no information.

Incidents get worse and better as understanding improves, and the process has to allow for both directions. Organisations are usually comfortable escalating and strangely reluctant to downgrade, which ties up people and attention on something already understood. Severity should be a current assessment, reviewed, not a label applied once at the start.