StackGen State of Reliability 2026 | Incident Trends Report for SREs

When we analysed median resolution time by sector, MTTR didn't spread randomly — it organised into three distinct tiers. This held across every year from 2023 through 2026 YTD, which means industry tier explains where you land more reliably than any year-over-year trend does. The sectors within each tier share structural features that drive their recovery times, not just their incident rates.

Application-tier sectors — developer tools, consumer internet, SaaS and business software, observability, and e-commerce — resolve at around 1.7 hours. These sectors tend to run fast rollback paths, have blast radius contained within their own product, and staff teams built for rapid deploy-and-fix cycles. The newly broken-out AI Application sector sits in this tier.

Industry-infrastructure sectors — cloud infrastructure, communications, fintech and payments, and security and identity — take 3 to 4 hours. Three structural features lengthen response here: failures cascade into many downstream systems; resolution typically requires coordination with regulators, carriers, enterprise customers, or partners; and the cost of an incorrect remediation is high, so teams verify before acting. Communications is the slowest sector in the tier, partly because several providers disclose per-route incidents, inflating volume and widening their tail.

AI Model Providers sit in a distinct third band — operationally faster than Application-tier despite being functionally infrastructure. Median MTTR fell from 75 minutes in 2023 to 49 minutes in 2026 YTD. Three features drive this: most outages can be handled by rerouting to a sibling model or cached response; teams are staffed at scale-up pace with fast deployment pipelines; and per-token latency, error-rate, and output-quality telemetry give unusually rich signals that compress time-to-diagnosis.

Industry membership explains roughly 8 percentage points of MTTR variance. The company itself explains ~20 points — about three times more. The remaining ~65 points is incident-level noise no observable predictor captures (which on-caller answered the page, time of day, whether the right runbook fit).

The company-level driver is Response Maturity: the combination of Context (observability and signals), Tooling (automation and runbooks), People (on-call practice), and AI (the augmentation layer). Firms with the highest Response Maturity in their tier recover 3× faster than firms with the lowest, irrespective of which failure mode they face most often.

The six archetypes each pair a failure signature with a recovery fingerprint. Dependency-Driven teams are slow because the fix isn't theirs to push. Velocity-Driven teams break hard but own the rollback. Scale-Driven firms are the most operationally efficient — lowest major-severity share, fastest median.

Movers drift predictably: away from Velocity-Driven (change-induced failure) toward Scale-, Data-Integrity-, and Substrate-Driven (growth, data, and metal failures). The archetype you're heading toward matters as much as the one you're in today.

AI appears in three incident categories. Category 1: AI providers fail and downstream products cascade. Category 2: the service is up but model output is wrong or degraded — fastest-growing type, 89× in one year inside the AI-native cohort. Category 3: autonomous agents take destructive action — structurally invisible to status-page methodology.

Five of the eleven or more documented agent-destruction events involved the agent autonomously scanning its environment for an over-scoped credential or token. The common pattern: the agent located an API token, then called a destructive mutation against production. "Don't give the agent dangerous permissions" is necessary but not sufficient — the tokens reachable from the runtime need to be inventoried.

Third Party Cascade is the largest single failure pattern across every year of 2023–2026 YTD. The 2026 share dip from 35% to 26% reflects a single structural factor: no event has reached the downstream footprint of AWS October 2025 (223 firms) or Cloudflare November 2025 (127 firms). The modal cascade affects just one disclosing company.

Azure ran against the broader 2026 trend — cascade volume up ~1.9× Jan–May 2026, while AWS, GCP, and Cloudflare were all down. A +300% spike in Microsoft 365/Outlook cascades (mostly the 22 January Outlook outage) drove much of the Azure rise.

Response Maturity has four components: Context (observability signals), Tooling (automation and runbooks), People (on-call practice), and AI (the augmentation layer). Most firms sit between Weak and Typical on at least two — the AI component is consistently the most under-invested.

The four-step cascade escalation ladder: (1) detect and wait; (2) pre-built failover with lead time; (3) dual-provider hot-swap — automatic; (4) full vendor migration. AI augments Steps 2–3 but only after Tooling pre-investment is in place. That architectural work is what converts a low-AI-applicability step into a high one.

The reason broad MTTR has been flat: most operators are still applying wait-restart-rollback patterns. The gap between catalog AI-applicability (70%+ non-trivial potential) and observed improvement is the gap between architectural readiness and prevalence.