Here's an uncomfortable number for anyone running production infrastructure: 76% of enterprises with high availability and disaster recovery protection in place still had at least one outage longer than 10 minutes in the past year. Nearly a quarter had three or more.
That's not a story about companies skipping HA/DR. It's a story about HA/DR that doesn't hold up under real conditions. SIOS Technology surveyed more than 250 IT leaders across North America and the UK for its 2026 State of Application Resilience Survey, and the results point to a specific set of technical failure modes, not a lack of investment.
Start with where these applications actually run. Only 2% of respondents are on-premises only. Ninety-two percent operate in hybrid or multicloud environments, and most of them aren't standardized on one cloud vendor — they're running different vendors for different workloads. Add in the OS layer: 86% run Windows for critical applications, but 32% also run Red Hat Enterprise Linux, 18% run Oracle Linux, 16% run Ubuntu, and 12% run SUSE. If your HA/DR tooling was built for one platform or one cloud, you're already patching around it.
Complexity, not cost, is the top blocker. Forty-four percent of respondents named configuration and management complexity as their biggest HA/DR challenge — almost 8 points ahead of the runner-up, integration with existing systems (37%). Cost ranked lower, behind both. That's worth sitting with. The industry has spent years pricing HA/DR as a budget conversation. The people actually running it say the real cost is operational: too many moving parts, too many platform-specific tools, too much manual intervention when something fails.
Then there's disaster recovery testing, which is where the gap gets worse. Only 7% of organizations test their full DR process monthly — the cadence most DR frameworks recommend for mission-critical systems. A third test once a year. And 22% don't know how often their organization tests at all. A DR plan nobody has run in months, or that nobody can even confirm has been run, isn't a plan you can trust when a real failure hits.
Satisfaction tracks with all of this. Only about half of respondents are satisfied with their current HA/DR solution. More than a third are neutral. Eleven percent are outright dissatisfied. When your failover strategy works "well enough" for a third of the market and not at all for another chunk, that's a tooling problem, not a discipline problem.
Patching is becoming an HA use case, not just a DR one
The most interesting finding for anyone who owns implementation, not just architecture, is what's happening with patch management. Seventy-two percent of respondents either already use HA clustering to manage patching or would consider it. Fourteen percent say it's already integral to how they patch.
The logic is straightforward once you see it: a cluster built to fail applications over during an outage can do the same thing during a planned maintenance window. Patch one node, fail over, patch the other, fail back — near-zero downtime, and no separate maintenance-window negotiation with the business. As vulnerability disclosure cycles get faster and patching windows get shorter, that's a real operational win, not a marketing angle. It's also why cybersecurity and HA/DR are showing up together on spending priority lists — SIOS found DR protection ranked second only to cybersecurity itself among planned IT investments over the next 18 months, ahead of infrastructure upgrades, new software deployments, and analytics.
SAP shops have their own version of this uncertainty. Among respondents running SAP, 17% are implementing SAP RISE, 17% are staying on cloud-based SAP, 12% are staying on-prem, and 32% don't know their future plans yet. That's a third of the SAP install base without a clear resilience strategy for a migration window that's coming whether they've planned for it or not.
None of this points to a single villain. It points to a mismatch between how HA/DR was architected — often per-platform, per-cloud, replication-first — and how infrastructure actually looks now: mixed OS, mixed cloud, patched under pressure, tested rarely. The fix isn't more failover capacity. It's application-aware clustering that treats Windows and Linux, on-prem and cloud, the same way, and DR testing that happens often enough to mean something.
As Masahiro Arai, COO of SIOS Technology Corp., put it: "Organizations need intelligent, application-aware clustering solutions that simplify operations, accelerate patching, improve cyber resilience and ensure continuous availability across increasingly complex environments." The survey backs that up with numbers. The 76% outage rate is the one worth remembering the next time someone says HA/DR is a box you check once.
