Your Provider's Outage Is Your Outage

The Decision in Front of You

Payments, customer service, identity, endpoint security, networking and hosting now sit with a handful of providers at most companies. When one of them fails, the company is down, and its customers, regulators and shareholders hold the company accountable.

The board decides whether that exposure is managed as a business risk with an owner, a measure and a plan, or left with procurement. One faulty security update in July 2024 cost the largest US companies an estimated $5.4 billion, and insurance was expected to cover a small fraction of it ⁵.

What's Happening

Third parties cause most public outages

Over nine years of tracking publicly reported outages, Uptime Institute found that third-party IT and data center providers, including cloud and internet companies, telecoms and colocation firms, accounted for about two-thirds of them ¹. Its 2026 analysis found fiber and cable problems were the leading cause of public IT outages in 2025, and telecom outages rose well above their 2020 to 2025 average ². Third-party outages are most often linked to software and configuration errors ².

About four in five operators run their own risk assessments, but only 39% assess systemic third-party risk ². Only 18% of organizations surveyed insure against cloud provider outages ².

Recent cases

CrowdStrike, July 2024. On July 19, 2024, CrowdStrike pushed a content configuration update to its Falcon sensor for Windows ⁴. The update crashed the machines it reached. Microsoft estimated 8.5 million Windows devices were affected, under 1% of all Windows machines, and CISA confirmed the cause was the update and no attack ³. The small share mattered less than where those machines sat, in airlines, health care and banking ⁵. Parametrix, a cloud outage insurer, estimated direct losses of $5.4 billion for the US Fortune 500 excluding Microsoft. About a quarter of those companies were affected, including every airline in the group, and insurance was expected to cover only 10% to 20% of the loss ⁵.

Delta Air Lines canceled about 7,000 flights over five days, affecting 1.3 million customers, and put its cost at $500 million or more ⁶. Delta and CrowdStrike then disputed responsibility in public ⁶. The vendor's error became Delta's operating loss, and any recovery from the vendor would come later, through a dispute.

Cloudflare and its cloud provider, June 2025. On June 12, 2025, Cloudflare lost a set of its own services for about two and a half hours ⁷. The cause sat one layer further down: part of the storage behind its Workers KV product ran on a third-party cloud provider that was having its own outage. About 90% of Workers KV requests failed, and Cloudflare Access failed every identity-based login during the event ⁷. Companies that used Cloudflare Access for employee sign-in were relying on a cloud provider they had no contract with and had never assessed. Cloudflare committed to removing the dependency on any single provider for that storage ⁷.

CDK Global, June 2024. CDK supplies the dealer management software used by more than 15,000 car dealership locations in the US and Canada. After two cyber incidents, it shut its systems down on June 19, 2024, and many dealers went back to paper ⁸. Anderson Economic Group estimated dealer losses above $600 million in the first two weeks, and projected $944 million if the outage ran into a third week ⁸. One vendor serving thousands of dealers turned its outage into theirs.

Two 2025 cloud events reinforce the pattern. An AWS DNS fault in Northern Virginia disrupted most services in that region for up to 15 hours in October ⁹. Nine days later, a configuration change at Microsoft's Azure Front Door caused about eight hours of disruption across Azure services, including Entra ID, Microsoft's identity platform ¹⁰.

Regulators have moved first in finance

European and UK financial regulators now treat concentration on technology providers as a systemic risk.

The EU's Digital Operational Resilience Act, Regulation (EU) 2022/2554, requires financial firms to keep a register of every ICT services contract, distinguish the ones that support critical or important functions, and report it to supervisors ¹¹. For those critical contracts, firms need documented exit strategies that are tested and reviewed periodically, with identified alternatives and transition plans ¹¹. Before signing, they must assess whether the provider is easy to substitute and whether the contract adds to existing reliance on the same or closely connected providers ¹². On November 18, 2025, the European Supervisory Authorities designated 19 critical ICT third-party providers for direct oversight, using data from those registers ¹³¹⁴. Where a provider ignores remediation, supervisors can, as a last resort, require financial firms to suspend or terminate its services ¹⁴.

In the UK, HM Treasury designated Amazon Web Services, Google Cloud, Microsoft and Oracle as critical third parties, and the Bank of England, the PRA and the FCA began overseeing them on July 13, 2026 ¹⁵. The regulators state that regulated firms remain responsible for their own due diligence, risk management and contingency planning ¹⁵.

The rules bind only financial firms, though the same reasoning fits any company whose revenue depends on a few providers.

Why the Usual Approach Fails

Vendor management in most companies is a procurement function that checks for a SOC 2 report and signs a contract with an availability target. None of that measures concentration.

Service credits are small. In the author's experience they are a percentage of the monthly fee for the affected service, which is tiny next to lost revenue. Even insurance closes little of the gap: in the CrowdStrike estimate, insured losses were 10% to 20% of the total ⁵.

Dependencies hide in layers. A company may hold separate contracts for identity, customer support, payments and hosting, and assume it has spread its risk. If three of those run on the same cloud region or behind the same edge network, one failure takes them all, as Cloudflare's customers learned ⁷.

Shared failure feels safe, since customers seem to forgive an outage that hits half the internet. Delta's $500 million shows what a shared outage can still cost one company ⁶.

Exit plans exist only on paper. A plan to move off a critical vendor that has never been rehearsed gives no reliable estimate of how long the move would take. DORA requires exit plans for critical services to be sufficiently tested ¹¹.

The Framework: Map, Rank, Respond

The approach has three steps and four possible responses per vendor.

flowchart LR
    A[Order platform] --> D[Cloud region A]
    B[Customer portal] --> E[SaaS identity provider]
    C[Employee remote access] --> F[Security edge service]
    E --> G[Shared edge network]
    F --> G
    B --> G
    E --> D
    H[All laptops and servers] --> I[Endpoint security agent<br/>automatic updates]

Map. For each critical service, list every vendor it needs to run, then ask each of those vendors which cloud, network and software providers they depend on. Include software that runs on your own machines and updates itself, such as endpoint security agents, since CrowdStrike showed that an agent installed everywhere is a single point of failure ³⁴.

Rank. Score each vendor on the number of critical services that stop if it fails and on the time needed to replace it or work around it. DORA's pre-contract test looks at the same two factors: substitutability and accumulated reliance on one provider ¹².

Respond. Assign each vendor one of four responses, owned by a named executive.

Accept the risk where a vendor supports nothing critical, and say so in writing. Buffer where replacement is slow: add caching, manual fallbacks, staged updates and break-glass access so the business keeps working while the vendor recovers. Diversify where a second provider is cheap and the switch can be automated, as with DNS. Prepare to exit where a vendor is critical and hard to buffer: keep data exportable, contracts terminable and an alternative identified, as DORA asks of financial firms ¹¹.

Costs, Risks, and Tradeoffs

How to Act

Questions to Ask Your Team

1. Which single vendor, if it failed tomorrow, would stop the most revenue?
2. Which of our critical vendors run on the same cloud region or edge network?
3. What software updates itself on every laptop and server, and can we stage those updates?
4. How would staff sign in to critical systems if our identity provider were down for a day?
5. For our most critical platform, how long would it take to move to an alternative, and have we ever tested the data export?
6. What would our service credits pay out against a 24-hour outage, compared with the revenue lost?
7. Does our insurance cover losses from a provider's outage?

Closing

Customers see your company failing to take an order, board a passenger or open a medical record, and the vendor behind it stays invisible to them. Map the vendors beneath your critical services, rank the concentrations, give each one an owner and a response, and test the responses before a provider's outage tests them for you.