Written by: Nimesh Chakravarthi, Co-founder & CTO, Struct
Key Takeaways
- AI root cause analysis (AI RCA) automates alert ingestion, deduplication, telemetry correlation, and change attribution to deliver ranked, evidence-backed hypotheses without manual triage.
- Manual diagnosis consumes 60–80% of MTTR, and AI RCA compresses this phase from 30–45 minutes to under 5 minutes, delivering an 80% reduction in triage time.
- Effective AI RCA correlates four signal types, metrics, logs, traces, and change events, while operating with least-privilege access, confidence thresholds, and human approval gates.
- Incident resolution verification automatically confirms resolution against live observability data on a ~1-minute loop and eliminates premature-close failures that cause incidents to re-fire.
- Struct automates your on-call runbook by deploying in under 10 minutes, integrating with Datadog, Sentry, GitHub, Slack, and other tools, and providing both AI RCA and incident resolution verification out of the box.
Why AI Root Cause Analysis Matters for Production Reliability and MTTR
Manual alert triage across fragmented observability tools is the single largest driver of high MTTR. Industry benchmarks place average enterprise MTTR in the range of several hours, and research popularized in The Visible Ops Handbook found that roughly 80% of MTTR is spent identifying which change or component caused the outage. For fintech teams bound by strict SLAs, every minute of manual log-hunting directly erodes the resolution window.
The cost is not only time. A $200k/year senior engineer spending a full week reacting to recurring alerts produces zero product velocity. This productivity loss compounds as teams scale, because newer engineers cannot own on-call shifts without the tribal knowledge required to navigate five disconnected tools under pressure. Senior engineers get pulled into every incident regardless of severity, which further erodes their capacity to ship features.
AI RCA compresses the diagnosis phase from 30–45 minutes to under 5 minutes, delivering an 80% reduction in triage time. Without AI RCA, the manual diagnosis phase often consumes the majority of MTTR. With AI RCA, teams reclaim engineering hours and reduce burnout while keeping SLAs intact.
Struct customers report an 80% reduction in triage time. At Arcana, a fintech running Sentry, GitHub, GCP Cloud Logging, and Slack, average investigation time dropped from 30 minutes to 2 minutes, reclaiming 56 developer hours per month across 2,100+ automated investigations.
Vendor Comparison: Datadog Bits AI, Sentry Seer, incident.io, Rootly, and Struct
This comparison table summarizes pricing models, key integrations, and stated limitations for five platforms. Every data point is cited inline.
| Vendor | Pricing Model | Key Integrations | Stated Limitations |
|---|---|---|---|
| Datadog Bits AI | Add-on to existing Datadog subscription, usage-based on AI queries. Datadog Infrastructure Pro starts at $15 per infra host per month when billed annually. | Datadog metrics, logs, traces, APM, dashboards natively, limited cross-stack reach outside Datadog. | Investigation scope is bounded to Datadog telemetry and does not natively correlate Sentry issues, GitHub deploy history, or cross-stack cloud logs without custom configuration. |
| Sentry Seer | Included in Sentry plans, Seer features available on Team ($26/mo) and above. | Sentry issues, stack traces, replays, and performance data natively. | Seer is limited to Sentry’s own telemetry and does not correlate infrastructure metrics, cloud logs, or deploy history from external tools. |
| incident.io | incident.io offers a free Basic plan, and its lowest paid tier (Team) starts at $15/user/month (annual) or $19/user/month (monthly). | Slack, PagerDuty, Datadog, GitHub, Jira, Linear, and StatusPage. | One of the few vendors with PR- and commit-level attribution, but the primary focus is incident workflow management rather than automated telemetry correlation and RCA. |
| Rootly | Rootly starts at $20/user/month. | Slack, PagerDuty, Datadog, GitHub, Jira, Confluence, and Zoom. | Rootly customers report 70%+ MTTR reductions, and the platform is workflow-first and relies on integrations for telemetry rather than performing autonomous cross-stack log and trace correlation. |
| Struct | Startup tier (up to 5 users, 30 issues/mo) available free, Growth tier (unlimited users, 200 issues/mo) and Enterprise (custom) with 30-day risk-free pilot. | Slack, GitHub, Sentry, Datadog, Prometheus, Grafana, GCP, AWS CloudWatch, Azure, Loki, Sumo Logic, PagerDuty, Linear, Jira, and Claude Code. | Requires existing logging and alerting instrumentation and is not suited for organizations requiring full on-premise deployment with zero log egress. |
AI RCA compresses the diagnosis phase, but diagnosis alone does not guarantee that an incident stays resolved. The next capability, incident resolution verification, closes the loop by confirming that remediations actually worked.
Incident Resolution Verification for Closed-Loop Reliability
Incident resolution verification is the automated process of confirming that an incident is genuinely resolved by checking live observability data, not by accepting an engineer’s manual “resolved” status update. Without automated verification, incidents are frequently closed prematurely based on an engineer’s assumption that a fix worked, only to re-fire 10 minutes later when the underlying condition persists. No dedicated platform owned this category before Struct’s Incident Tracker launched.
Struct’s Incident Tracker runs a ~1-minute automated verification loop against connected observability data after a remediation action is taken. The loop checks whether the error rate has returned below threshold, latency is within SLO band, and the triggering alert condition has cleared before marking the incident closed. This approach eliminates the common failure mode where an incident is closed prematurely and re-fires shortly afterward.
Rootly’s AI SRE measurement framework defines verification pass rate as the percentage of approved actions that improve defined success signals, with pass criteria required to be defined before the action runs, a standard Struct’s Incident Tracker implements automatically against real telemetry rather than requiring manual configuration per incident type.
This closed-loop approach also feeds back into alert quality. Struct’s Deploy Guard adds instrumentation review at the pull request level and post-deploy health checks, which improves alerting quality before incidents happen rather than only after.
See how Struct’s incident verification loop works in your stack
How AI Root Cause Analysis Fits into a DevOps Pipeline
AI RCA in a DevOps pipeline intercepts alert events the moment they fire, autonomously queries connected observability and code platforms, and produces a ranked, evidence-backed root-cause hypothesis before a human opens their laptop. The investigation layer sits on top of existing observability tooling and does not replace Datadog, Grafana, or Sentry.
Struct connects to Datadog metrics, logs, and traces as primary inputs while adding cross-stack investigation into Sentry, GitHub, cloud logging, and other tools. The result is a single dynamically generated dashboard that contains a unified timeline, supporting charts pulled from observability platforms, and the queries used to reach each conclusion. This replaces the manual process of context-switching across five separate SaaS tools.
That workflow depends on the AI system having access to the right telemetry inputs. Without structured signals across metrics, logs, traces, and change events, the correlation engine has nothing to reason over.
Telemetry and Change Events AI RCA Should Correlate
Effective AI RCA requires correlating four signal types, metrics, logs, traces, and change events. An AI SRE platform should reason across these pillars in order, events first to identify what changed, metrics to scope blast radius, traces to attribute failure to a service boundary, and logs to verify the hypothesis.
The recommended correlation inputs for each signal type are:
- Metrics: Error rates, latency percentiles, and saturation signals from Prometheus, Datadog, or Grafana. OpenTelemetry attributes such as service name, endpoint, HTTP status code, and region turn simple time series into dimensional streams that can be sliced for RCA.
- Logs: Structured JSON logs emitting trace_id, span_id, service name, version, error.type, and error.message on every line enable reliable cross-signal correlation.
- Traces: Distributed traces from Datadog APM, GCP, or Azure that carry trace IDs propagated across service boundaries and allow the system to connect a metric anomaly to a specific failing service call.
- Change events: Deployments, feature flag changes, configuration pushes, and infrastructure actions must carry structured metadata including timestamp, service identifier, actor, and a commit SHA or flag name to enable correlation with alerts. GitHub deploy history is the primary source for Series A–C teams.
Guardrails for Safe AI Incident Investigation Agents
AI agents performing incident investigation must operate with bounded scope, explicit confidence thresholds, and human approval gates for any action that touches production infrastructure. The reason these guardrails work is that automated incident triage is fundamentally a read-heavy task, where agents observe and summarize telemetry rather than making changes, which keeps the blast radius of errors low even when the AI draws an incorrect conclusion.
The recommended guardrail architecture for AI RCA agents is:
- Least-privilege tool access: A diagnosis agent should have extensive read permissions but zero write permissions. A remediation agent should have write permissions scoped strictly to the namespace it is repairing.
- Confidence thresholds: Human-in-the-loop thresholds set at 80–95% confidence serve as the primary blast-radius control. Autonomous actions require 0.95 confidence, supervised actions require 0.85 with a 5-minute veto window, and gated actions such as data deletion require mandatory human approval regardless of confidence.
- Human approval gates: Any action touching production infrastructure, including scaling decisions, config changes, and rollbacks, should require a human approval step by default, with auto-approval enabled only after a documented history of correct decisions in that specific scenario.
- Circuit breakers: Circuit breakers must halt agent action chains when anomalous behavior is detected, such as unexpected cost spikes, repeated failed remediations, or unusual API call patterns. Unbounded agent recursion is prohibited in production.
- Immutable audit logs: Production agent systems must maintain replayable audit trails storing prompts, tool inputs and outputs, and policy decisions so any incident can be fully reconstructed.
Struct’s investigation agents are read-only by design during the triage phase. Remediation handoff, including PR creation, requires explicit engineer review before execution and implements the human-in-the-loop model that Microsoft’s Azure SRE Agent adopted in 2025, which requires human approval for all remediations in production environments.
How to Measure MTTR Reduction from AI RCA
MTTR reduction from AI RCA should be measured as a set of stages rather than a single number, including time to detect, time to AI triage, time to human validate, time to contain, and time to resolve. Tracking each stage timestamp in your incident management layer reveals where automation is compressing the timeline and where manual steps remain.
Concrete benchmarks from production deployments include:
- Arcana reduced median investigation time from 30 minutes to 2 minutes and reclaimed 56 engineer-hours per month after deploying Struct on top of their existing Sentry, GitHub, GCP, and Slack stack.
- Arcana scaled investigation coverage 17x while maintaining an >80% helpful investigation rate.
These results demonstrate the concrete MTTR improvements teams achieve when AI RCA compresses the diagnosis phase from manual tool-hopping to automated cross-stack correlation. The leading indicator to track before MTTR improves is investigation time per incident. If the AI investigation layer is working, the time between alert fire and first evidence-backed hypothesis should drop to under 5 minutes. MTTR follows as a lagging indicator once the diagnosis phase is consistently compressed.
Should You Build or Buy an AI RCA Solution?
Most Series A–C teams reduce risk and cost by buying an AI RCA platform instead of building one. Building an internal AI RCA system requires maintaining prompt engineering, telemetry connectors, context window management for large log volumes, deduplication logic, and a verification loop, all while shipping product. For most teams with 15–80 engineers, this engineering cost exceeds the cost of a purpose-built solution.
The build-vs-buy framework for AI RCA is:
- Build if: Your stack is entirely proprietary, your logs cannot leave your VPC under any circumstances, and you have a dedicated platform team with SRE capacity to maintain the system.
- Buy if: You run standard observability tooling such as Datadog, Sentry, Prometheus, or Grafana, your compliance requirement is SOC 2 Type II or HIPAA rather than full on-premise, and you need investigations running in days rather than quarters.
Struct deploys in under 10 minutes, integrates with leading observability platforms, Slack, GitHub, Linear, and Claude Code, and is fully SOC 2 Type II and HIPAA compliant. Composable runbooks allow teams to encode their specific on-call procedures, including custom correlation ID formats and proprietary escalation paths, so the AI investigates exactly as a senior engineer would. A 30-day risk-free pilot is included on all paid tiers.
Start your 30-day risk-free pilot
Frequently Asked Questions
Is our data secure enough to use an external AI RCA platform?
Struct is SOC 2 Type II and HIPAA compliant, with full compliance documentation at trust.struct.ai. Logs and telemetry are accessed and processed ephemerally, and they are not stored permanently by the platform. For the majority of Series A–C B2B SaaS companies, including fintech teams, this compliance posture meets standard security requirements. If your organization mandates that zero logs leave your internal VPC and requires full on-premise deployment, Struct is not currently the right fit.
What happens if our logging and telemetry quality is poor?
AI RCA is only as effective as the telemetry it can access. If your system lacks structured logs with trace IDs, consistent field names, or basic alerting triggers, the investigation layer cannot reliably correlate signals across service boundaries. The baseline requirement for Struct is that your team already uses tools like Sentry or Datadog for exceptions, cloud logging such as AWS CloudWatch, GCP, or Azure for infrastructure logs, and Slack or PagerDuty for alert routing. Teams without this foundation should instrument their stack before deploying AI RCA.
How quickly can a new engineer take on-call shifts with AI RCA in place?
AI RCA removes the tribal-knowledge bottleneck that prevents new engineers from owning on-call. When an alert fires, Struct produces a pre-assembled investigation that includes correlated logs, a unified timeline, a blast radius summary, and suggested fixes before the engineer opens their laptop. A new hire does not need to know which Datadog dashboard to check or which Sentry project to query, because the starting point is provided automatically. Teams using Struct report that newer engineers can confidently manage on-call shifts from their first rotation rather than requiring senior escalation for every non-trivial alert.
Can we customize how Struct investigates our specific alert types?
Struct supports custom instructions, proprietary correlation ID formats, and direct input of internal on-call runbooks. Composable widgets allow teams to guarantee that specific visual data, such as particular metrics charts, specific log queries, or custom service dependency views, is always pulled for defined alert types. The AI follows your exact operational procedures when an alert fires rather than applying a generic investigation template.
Does Struct replace our existing observability stack?
Struct does not replace your observability stack and instead acts as an investigation layer that sits on top of existing observability tooling. It ingests data from Datadog, Grafana, Sentry, Prometheus, AWS CloudWatch, GCP, Azure, and other platforms as inputs. Engineers continue using their existing dashboards and alerting configurations. Struct adds the automated first-pass investigation, cross-stack correlation, and incident resolution verification that observability platforms do not perform natively.
Conclusion
Manual root-cause hunting across fragmented observability tools is the primary driver of high MTTR and on-call burnout for Series A–C engineering teams. AI root cause analysis deployed inside your existing DevOps stack removes the manual diagnosis bottleneck that drives high MTTR, as demonstrated by the 80% triage-time reductions documented earlier. The closed-loop addition of incident resolution verification, which automatically confirms resolution against live observability data on a ~1-minute cycle, eliminates the premature-close failure mode that causes incidents to re-fire.
Struct provides both capabilities out of the box, including automated first-pass investigation before an engineer opens their laptop and a production-grade incident resolution verification loop. Setup takes under 10 minutes, compliance is SOC 2 Type II and HIPAA, and a 30-day risk-free pilot is included.
