What is Mean Time to Recovery?
Also called MTTR, mean time to restore.
Mean time to recovery is the average elapsed time between the start of a service impairment and the restoration of normal service. It is measured across a set of incidents over a period and is used to characterize how quickly an organization contains failures, as distinct from how often failures occur.
The measured interval decomposes into detection, acknowledgment, diagnosis, and remediation. Improvements in each phase come from different work: detection improves with better instrumentation and alert coverage, acknowledgment with on-call routing and escalation, diagnosis with logs and traces that answer questions without a code reading session, and remediation with rehearsed procedures such as a tested rollback. Reporting only the total average hides which phase actually dominates.
The metric's definitions are inconsistent across the industry, which limits cross-organization comparison. Some teams start the clock at customer impact, others at detection, and the endpoint may be full restoration, partial mitigation, or root cause resolution. The abbreviation is also used for mean time to repair, respond, or resolve, which are genuinely different quantities. Any published figure needs its definition attached to mean anything.
The mean is a poor summary of a skewed distribution. A handful of long incidents dominate the average while most incidents resolve quickly, so a rising mean may reflect one unusual event rather than a systemic decline. Median and upper percentiles, reported alongside the count of incidents, give a far more honest picture, and small incident counts make any statistic noisy.
For AI agent systems, recovery often means stopping ongoing incorrect activity, not just restoring availability. An agent that continues acting on bad instructions is doing damage while it runs, so containment mechanisms such as a kill switch, a flag that disables a tool, and a queue drain matter more than restart speed. Recovery may also include reversing actions already taken, which is slower than restarting a stateless service.
Key points
- Average time from impairment start to service restoration
- Decomposes into detect, acknowledge, diagnose, and remediate
- Definitions vary widely, so figures need their definition stated
- Skewed distributions make median and percentiles more informative
- Agent recovery includes stopping activity and reversing actions
In practice
A team reviews twelve incidents from a quarter. The mean recovery time is 47 minutes, but the median is 14 and one outage of six hours drives most of the mean. Breaking the timeline down shows detection averages two minutes while diagnosis averages 29, because a shared identifier was missing from tool call logs. Adding it becomes the quarter's reliability item.