Reading the Telemetry: Separating Support Metrics That Forecast Outages from Those That Flatter Vendors

Renewal season has a familiar rhythm. The managed services provider books a review meeting, presents a polished deck, and walks through a series of metrics that all seem to point the same direction: tickets answered quickly, satisfaction scores healthy, SLA compliance in the high nineties. The contract renews. Three months later, a critical outage lands anyway, and the executive team asks the obvious question — didn't the numbers say we were fine?

They did. The problem is that most of the numbers on that deck were never designed to predict downtime. They were designed to predict renewals.

The Vanity Tier: Three Metrics That Measure Theater

Before cataloging what works, it's worth naming what doesn't. Three metrics appear in nearly every vendor review and carry nearly no predictive value for outage risk.

Average response time. How fast a ticket is acknowledged says nothing about how fast it is resolved. Acknowledging an outage in four minutes while the system stays down for six hours is compliance, not capability. Vendors love this metric because it is easy to hit and easy to display in green.

First-contact resolution percentage. Useful in consumer help desks, largely meaningless in enterprise infrastructure support, where the hardest and most consequential problems are precisely the ones that cannot be resolved on first contact. A high FCR score can indicate a support team that cherry-picks easy tickets and escalates the rest — which brings us to the metrics that matter.

Customer satisfaction (CSAT) surveys. Satisfaction measures how the interaction felt, not what it changed. Outage-prone environments can post excellent CSAT scores for years, because surveys capture the courtesy of the engineer, not the fragility of the architecture.

None of these are worthless. They are simply the wrong instruments for the job of outage prediction.

The Predictive Tier: Five Metrics That Actually Move

1. Mean Time to Detect (MTTD)

The single most predictive metric in the stack. Downtime duration is largely a function of detection lag — every minute between failure and awareness is a minute added to the outage regardless of how fast remediation proceeds afterward. Ask your provider for their MTTD trend over the trailing twelve months, segmented by severity. A flat or rising MTTD on critical incidents signals monitoring gaps that will eventually surface as an outage.

2. Change Failure Rate

Borrowed from DevOps research, change failure rate measures the percentage of changes — patches, configuration updates, deployments — that cause an incident or require rollback. Industry benchmarking consistently places healthy environments in the low teens or below. In managed infrastructure arrangements, a change failure rate above 25% is a leading indicator of future unplanned downtime, because it reveals either weak pre-production validation or changes being made without adequate visibility. This is the metric most likely to be absent from a renewal deck, for exactly that reason.

3. Ticket Escalation Patterns

Not the escalation rate itself, but its shape. Healthy support operations escalate a stable, modest share of tickets. What predicts trouble is an escalation pattern that is trending upward, or one in which the same subsystems appear repeatedly at tier three. Repeated escalations into the same component mean chronic defects are being triaged rather than fixed — a slow leak that ends as a breach.

4. Recurring Incident Ratio

The percentage of incidents that are repeats of previously documented problems. Every repeated incident represents a root cause that was patched, not resolved. A recurring incident ratio above 10–15% on critical systems suggests the support model is managing symptoms, and symptom management has a fixed ceiling before it becomes an outage.

5. Failed Preventive Maintenance Completion

The least glamorous and most honest metric on the list. Did scheduled patching, capacity reviews, backup verification, and failover testing actually happen — on time, with documented results? Deferred preventive work is the closest thing infrastructure support has to a countdown clock. Providers that report this proactively are telling you something important about their operating culture; providers that don't are telling you something too.

A Buyer's Checklist for the Next Renewal

When the review meeting arrives, restructure the conversation around outcomes:

• Demand MTTD and change failure rate as contractual SLAs, not dashboard garnish. If the provider resists committing to them, that resistance is data.
• Require quarterly incident forensics — root cause analysis for every severity-one event, with corrective actions tracked to closure.
• Negotiate credits tied to detection and prevention, not response acknowledgment. Time-to-detect penalties align the vendor's incentives with yours.
• Ask for the recurring incident ratio by subsystem, and make remediation of the top repeat offenders a statement of work.
• Get preventive maintenance completion in writing, with an auditable log.

From Promises to Evidence

The distinction that should govern every support contract negotiation is simple: response-time metrics describe what the vendor does after something breaks; the predictive metrics describe how likely the break is in the first place. A provider confident in its operations will volunteer the second category. A provider whose renewal deck is built entirely from the first is selling you theater — and your next outage is already on the calendar.