Methodology & Incident Response Playbook

Research methodology

Every number this site publishes traces to a documented corpus with documented rules. This is the credibility backbone: what goes in, how it is normalized, and where the method is weakest.

What enters the corpus

The corpus covers major public incidents at AWS, Microsoft Azure, and Google Cloud, 2017–2025 — currently 47 events, last updated June 30, 2026. An incident qualifies as major when the provider’s own disclosure (status history or post-event summary) shows all three of: multi-service or multi-region customer impact, duration over 30 minutes, and provider acknowledgement at its highest or second-highest severity convention.

Primary sources, in order of precedence: official post-event summaries (e.g. AWS PES, Azure PIRs, Google incident reports), provider status-page histories, and — for cross-checking timestamps — the live incident feeds collected by our data infrastructure. Press coverage is never a primary source.

Normalization rules

• Duration runs from first customer-visible impact to the provider’s declared resolution — not to the end of backlog draining, which is noted separately when disclosed. Where providers give ranges, we take the wider bound.
• Root cause maps the provider’s narrative onto six classes (configuration/change, software defect, capacity/overload, network/hardware, external attack, other/undisclosed). The mapping is ours; the narrative is theirs.
• Severity follows the severity matrix below, so “major” means the same thing across providers with different vocabularies.
• SLA breach is computed per affected service against the provider’s published monthly uptime target for a standard configuration; the credit-gap claim rate is a labeled practitioner estimate, not a measurement — no provider discloses claim volumes.

Known limitations

• Disclosure bias. Providers differ in what they publish. AWS’s higher incident count partly reflects more granular disclosure, not necessarily worse reliability. Cross-provider comparisons should be read with this caveat.
• Public-only. Incidents resolved without public acknowledgement are invisible to the corpus, which therefore under-counts small and single-tenant events.
• Small n. 47 events across nine years supports the medians and shares we publish; it does not support month-over-month trend claims, which is why we don’t make them.

Data infrastructure and independence

The live incident feeds used for timestamp cross-checking are collected by Next Signal, which supports this research. Editorial control, the normalization rules, and the published numbers are ours; the relationship is disclosed wherever it is relevant.

Citing this research

Cite as: CloudDowntime, “State of Cloud Reliability 2026,” clouddowntime.com/report/2026. Per-stat citations are printed next to each figure in the report and in the benchmark data. Corrections: when a provider revises a disclosure, we recompute and note the change with a dated correction.