Research

Measuring Mean Time to Recovery Without Fooling Yourself

How to define, measure and report MTTR honestly — and why the average alone hides the incidents that matter most.

Abstract illustration of incident recovery metrics

Mean time to recovery (MTTR) is one of the most quoted operations metrics, and one of the easiest to get wrong. This note looks at how to measure it in a way that actually helps.

Define the clock

Agree on exactly when the clock starts and stops:

  • Start: when the impact began — not when someone noticed it.
  • Stop: when users are no longer affected — not when the ticket was closed.

Measuring from detection instead of impact makes your numbers look better and hides slow detection.

Don’t report only the mean

A handful of long incidents can dominate the average, or a flood of tiny ones can hide them. Report alongside the mean:

  1. The median, to show a typical incident.
  2. The longest incident in the period, with a short summary.
  3. The count of incidents, so trends in frequency are visible.

Use it to ask better questions

MTTR is most useful when it prompts questions: Why did detection take 40 minutes? Why did we need three teams to restart one service? The number is the start of the conversation, not the conclusion.

Keep Reading

Related articles

Let’s Talk

Let’s build something reliable together

Open to consulting, speaking and collaboration across SAP administration, cloud infrastructure and cybersecurity — questions are always welcome.