| Vose Software

Industry: Telecommunications and IT
Product: ModelRisk
Application: Data Recovery Optimization under Uncertainty


When the Restore Misses RTO: Sizing the Real Distribution of Recovery Time

The contractual recovery-time objective on a major enterprise managed-services contract is RTO = 4 hours for tier-1 systems. The deterministic plan — sum the median backup-fetch, the median restore, the median validate — comes to 2.4 hours and looks comfortable. The simulation says the mean recovery time is 204 minutes (already past the 4-hour line), the P90 is 286 minutes (~4.8 hours), the P99 is 408 minutes (~6.8 hours), and there is a 25% chance a tier-1 restore breaches the 4-hour RTO. Recovery time is a sum of right-skewed components; the median is not the answer.

End-to-end recovery time (RTO) distribution

A managed-services provider running disaster-recovery for ~300 enterprise customers rebuilt its DR forecasting in ModelRisk. The model produces this full distribution of end-to-end recovery time and a parallel data-loss (RPO) distribution — the two metrics that govern every DR contract.

Four stages, each with its own distribution

End-to-end recovery is a serial pipeline. The total is the sum, but the shape of the total is dominated by the heavy-tailed components.

  • Backup integrity check. Beta(95, 2) — mean 97.9% success per attempt, occasional failure forces a fallback to the prior snapshot (adds ~1 hour). This is a probability and must be Beta-bounded; a Normal would draw values > 1.
  • Data-fetch time. LogNormal with median 35 min, σ_log = 0.8. The skew comes from variable WAN throughput and from rare events where a large database has to be re-hydrated from object storage. The mean fetch time (~48 min) is much higher than the median because of the tail.
  • System restore. Triangular(40, 90, 240 min). Skew right — restores hit unexpected dependency issues that lengthen the right tail more than the optimistic floor moves.
  • Validation pass. LogNormal median 25 min, σ_log = 0.6, with a Beta(98, 2) probability of passing first time; failure adds a re-validate cycle of mean 40 min.

Total RTO is the sum, with the backup-fallback and re-validation events introducing correlated jumps into the right tail.

What the deterministic plan got wrong

The legacy plan reported a median recovery of ~140 minutes and concluded the 4-hour RTO was a "two-hour buffer". The simulation, charted above, tells the operational reality:

  • Mean RTO: 204 minutes
  • P50: 195 minutes (above the deterministic plan, and already close to the 4-hour line)
  • P90: 286 minutes (~4.8 hours)
  • P99: 408 minutes (~6.8 hours)
  • P(RTO > 4 h SLA) = 25%

A 1-in-4 restore overshooting the RTO is not a "buffer" — it is a recurring SLA breach the deterministic plan literally cannot show, because the deterministic plan is summing medians of right-skewed distributions and getting a number that has no probabilistic interpretation at all.

What actually moves the tail

Sensitivity on the P90 RTO ranks the four stages by tail leverage — a very different ordering than ranking by mean contribution.

What drives the P90 recovery time

System-restore upper-bound dominates: shifting the triangular upper bound from 240 → 180 minutes (e.g. by adding pre-staged warm-spare configurations) moves P90 by ~30 minutes against a baseline P90 of 286 minutes. Data-fetch σ is second — and is exactly what a 10 Gbps WAN upgrade addresses. Validation re-run probability is third. Backup-integrity success rate is fourth: high mean reliability already, but a Beta(95, 2) is not the same as a Beta(99, 1), and the difference is mostly hidden in routine reporting.

Three DR architectures compared

Three architectures were simulated against the same workload:

Three DR architectures — RTO CDFs

  • Current state. Cold standby in secondary site, manual orchestration. Mean RTO 204 min; P(RTO > 4h) = 25%.
  • Pilot-light tier. Pre-provisioned compute, daily-sync block storage. Mean RTO 72 min; P(RTO > 4h) ≈ 0%.
  • Active-active. Live multi-region replication; RTO is effectively traffic-shift time. Mean RTO 13 min; P(RTO > 4h) ≈ 0%.

The active-active step-up adds an extra ~$2.8M/yr per customer in compute and replication egress, which only ~30 customers can justify. Pilot-light at ~$640k/yr/customer is the dominant choice for tier-1 contracts: it clears the 4-hour SLA in essentially every simulated restore without doubling cloud spend.

The RPO half of the question

RPO (data loss) is a separate distribution governed by the backup cadence. With hourly snapshots, RPO ≈ Uniform(0, 60) min on the time-since-last-snapshot — but real-world snapshot success introduces a heavier tail when consecutive snapshots fail.

Data-loss (RPO) distribution under hourly snapshot cadence

Mean RPO is ~31 min; P95 RPO is 58 min; the rare consecutive-failure tail pushes P99 RPO to 91 min. For contracts with a 60-min RPO clause, the simulation surfaced a previously invisible 2% probability of breach that the deterministic "we take hourly snapshots" claim concealed.

What changed

  • DR contracts re-tiered. Tier-1 SLAs moved from a flat 4-hour RTO to a published "P95 RTO ≤ 4h, P99 RTO ≤ 8h" — a more honest commitment that customers respected and that finance could price.
  • Pilot-light adopted as default for tier-1. Approval based on P(RTO breach) reduction from 25% to near-zero, not on mean RTO improvement.
  • Snapshot cadence tightened on 18 high-value contracts from hourly to every 15 minutes, dropping P95 RPO from 58 min to ~14 min — closing the previously hidden RPO-breach exposure.
  • One ransomware event handled with the model in the loop. During an actual incident the team ran the live restore parameters through ModelRisk and quoted the client a P50/P90 RTO with confidence — beat the P50 by 12 minutes.

ModelRisk Functionality Used

  • Beta-distributed integrity-check and validation pass rates (bounded on [0,1]) instead of Normal point-estimates that would draw probabilities outside the unit interval.
  • LogNormal on data-fetch and validation duration capturing the multiplicative-delay structure (paging × diagnosis × throughput × verification) that produces the heavy right tail.
  • Triangular system-restore distribution parameterised from incident-log min/mode/max, the only data the operations team consistently captures.
  • Compound recovery time as a sum of stages with correlated jumps (backup-fallback adds time and changes downstream validation distribution), reproducible across thousands of trials.
  • Sensitivity ranking on P90 RTO rather than mean RTO — surfacing the system-restore upper-bound and WAN throughput as the highest-leverage investments.
  • Three-architecture CDF comparison that converted the "pilot-light vs cold standby" debate from a qualitative argument into a single chart showing the ~25-point drop in SLA-breach probability.

The recovery plan's median is not the recovery plan's answer. The answer is the full RTO distribution against the SLA threshold — and Monte Carlo is what turns four stage-level distributions into one end-to-end number the DR team and the customer can both sign.