Detection time is the first metric

When a system depends on something outside your control, such as a third-party API, an upstream team or a vendor feed, it will break in ways you can't prevent. What you control is how long it stays broken without anyone knowing.

That gap, from broken to known, is where most of the damage happens. Bad data keeps flowing and downstream systems keep trusting it. By the time someone notices, the cleanup is far bigger than the original fault.

So before asking "how do we stop this failing?", I find it more useful to ask:

1. What does working mean, as a number? That is the SLI.
2. What number is unacceptable? That is the SLO.
3. Who finds out when it crosses the line, and how quickly?

Prevention is worth doing, but it comes second. A system that fails loudly within minutes is usually in better shape than one that fails rarely and silently.