How do you measure whether an AIOps investment is actually paying off — what does the before/after business case look like?

The credible case is a controlled comparison: capture 3-6 months of baseline (pages/shift, precision from dispositions, MTTR decomposed into detect/triage/mitigate phases, incident counts by severity, on-call survey scores), roll out to a subset of teams first, and compare against both their own baseline and non-adopting teams over the same period — this guards against attributing seasonal load changes or unrelated reliability work to the tool. Decompose MTTR: AIOps mostly compresses detection (anomaly detection vs threshold lag) and triage (correlation, context assembly, similar-incident retrieval); mitigation compression only comes with auto-remediation. Realistic published outcomes: large alert-volume reductions (70-95% is commonly reported), 20-40% Sev-2 MTTR improvement, near-elimination of 'customer told us first' incidents. Count costs honestly: platform licensing, integration engineering (the perpetually underestimated line — data quality and topology mapping dominate), tuning time, and the ongoing feedback-labeling discipline. Softer but decisive: whether SREs report doing more engineering and less firefighting — the programs that stick are the ones where reclaimed time visibly converts into architectural fixes.