Chaos Engineering: Fault Injection, Game Days, and Building

Chaos engineering is the discipline of deliberately injecting failure into production or production-like systems to discover weaknesses before real.

Chaos Engineering: The Practice of Breaking Production Before Production Breaks You

Chaos engineering is the practice of running controlled experiments that inject failure into a running system — killing servers, adding latency, corrupting responses, simulating regional outages — to verify the system degrades gracefully. Netflix pioneered it with Chaos Monkey in 2011; the underlying insight is that untested failure modes are functionally guaranteed to occur eventually, and finding them via deliberate experiment is dramatically cheaper than finding them via real incident.

The four steps of a chaos experiment

The Principles of Chaos Engineering document defines the loop: (1) Define steady state — measurable properties of a healthy system (checkout success rate, p99 latency). (2) Hypothesize the steady state continues under some failure — 'if we kill one API replica, success rate stays above 99.5%.' (3) Introduce the failure in a controlled scope. (4) Compare actual vs. hypothesized. Experiments that confirm the hypothesis build confidence; experiments that disprove it uncover bugs to fix. Skip the hypothesis and you're not doing chaos engineering, you're just breaking things.

Starting small: game days before automation

Netflix-scale automated chaos is not the right starting point for a 20-engineer team. Start with quarterly game days: a scheduled 2-hour block where the team meets, picks a failure scenario ('the primary database becomes unreachable'), and simulates it in staging or against a controlled production slice. Discuss what breaks, fix the biggest gaps, run the same scenario again next quarter to verify improvement. Game days build the muscle for real incidents and surface the same class of bugs as automated chaos, at a fraction of the setup cost.

What to inject

Common experiments in order of value/difficulty: (1) Instance termination — kill a random pod/VM, verify autoscaling and load balancing recover. (2) Network latency — add 500ms to calls to a specific dependency, verify timeouts and circuit breakers work. (3) Dependency unavailability — return errors from a downstream API, verify graceful degradation. (4) Resource exhaustion — fill disk, saturate CPU, verify alerts fire and the system doesn't cascade. (5) Region/AZ failure — simulate loss of a whole availability zone, verify failover. Start with #1 and #2; only advanced teams need #5.

Blast radius control

Chaos experiments must be scoped so a failed experiment doesn't take down customer traffic. Techniques: run in a copy of production with mirrored traffic; run against a small percentage of users with a fast rollback switch; run only during business hours with the team watching; have an explicit abort mechanism that returns the system to normal in under a minute. Chaos experiments that themselves cause outages are how the practice gets banned; strict blast-radius discipline is what makes it sustainable.

Tools worth knowing

Gremlin — commercial platform, wide range of experiments, best UX. Chaos Mesh, Litmus — Kubernetes-native, open source. AWS Fault Injection Service — AWS-managed, integrates with EC2/RDS/ECS. ToxiProxy — application-layer network fault injection, good for local dev testing. Netflix's original Chaos Monkey — still available, narrower scope. For most teams, starting with game days and simple scripts against your staging environment is enough; adopt a platform when the practice justifies the investment.

Frequently asked questions

Is chaos engineering only for huge companies?
No. Game days and scoped failure simulation are valuable at any size — arguably more valuable at 20 engineers than 2000, because small teams can't afford to learn about failure modes only from real incidents. Skip automated chaos at small scale; adopt game days regardless.
In production or in staging?
Start in staging to build confidence, then move to production with tight blast radius. Staging-only chaos misses production-specific failure modes (real load, real dependencies, real network topology). The end state is production experiments with strict controls, but that's a maturity destination, not a starting point.
How do we get leadership to approve breaking production?
Frame it in terms of avoided incidents. Every chaos experiment that finds a bug is a real incident that didn't happen. Track this — 'in the last year, game days surfaced 12 issues that would have been P1 incidents.' The math is hard to argue with once the practice has a track record.

Related fundraising guides (40)

Investor directory · Fundraising library · Articles A–Z · Company funding database