Simulating service disruptions for an operational production system

The techniques described herein provide evaluations of a production system's ability to recover from a service disruption without actually disrupting service to the production system. In some examples, a live production system is at least partly duplicated to create a shadow production system that is a quarantined copy of the production system. Traffic between the production system, client devices, and possibly dependency services may be replicated onto the shadow production system while a recovery simulation service induces a specified type of service disruption onto the shadow production system. Behavior of the shadow production system during service disruption is used to identify performance differences and to evaluate expected recovery characteristics of the live production system.