DDRTP: predicting how long recovery will really take

What was going on

A recovery time objective (RTO) is the longest a business can accept being without its data. But the usual ways of estimating it are static and simplistic. They ignore the things that actually change recovery time, so the RTO on paper and the real recovery during an incident often disagree.

We needed something that predicted recovery time dynamically, compared it with policy, and pointed to where it could be improved.

What I was asked to do

• Build an algorithm that calculates recovery time from several factors, including detection time, data complexity, damage scale and system performance
• Recalibrate predictions as conditions change
• Alert users when predicted recovery time exceeds the RTO
• Make it work across SaaS, IaaS and on-premises environments

What I did

The work combined models trained on historical recovery incidents with a weighted-factor approach.

• Identified and quantified the factors that influence recovery time
• Designed the algorithm that combines them into a prediction for each kind of environment
• Built the alerting that tells users when they are heading past their RTO
• Implemented it in a SaaS application that recalculates as things like API limits, data volume and system dependencies change
• Tested the accuracy and reliability of predictions across different scenarios

What changed

Organisations got accurate, real-time predictions and could line them up with their RTO policies. The alerts let people deal with recovery risk before it became an incident.

Doing it responsibly

The algorithm only processes anonymised metadata, so sensitive data is never exposed. Role-based access controls limit who sees the insights, and clear documentation explains how predictions are generated and used.