One vendor, one update, one outage: how shared technology becomes shared risk

On 19 July 2024 a faulty software update from the security company CrowdStrike crashed Windows computers around the world. Microsoft estimated 8.5 million devices were affected, under 1% of all Windows machines, per its own blog post, yet the effect was out of proportion because those machines were concentrated in airlines, hospitals, banks and broadcasters. Published estimates of the financial damage run to at least US$10 billion. There was no attack, only a bad update to a tool installed to prevent attacks.

It matters because it showed the blast radius of a mistake. An attacker who finds the same lever does not need to hack a thousand companies; they need to hack the one they share.

Verizon's 2025 Data Breach Investigations Report analysed more than 22,000 security incidents, including 12,195 confirmed breaches, and found that the share of breaches involving a third party doubled from 15% to 30% in a year. Vulnerability exploitation, particularly in edge devices and VPNs, also rose. Every business now depends on its suppliers' security, and often cannot see it.

• Vendor as door: attackers reach many customers by compromising one supplier or tool (the pattern behind the 2025 grocery-distributor incidents in retail).
• Vendor as blast radius: a common controller or product means one flaw affects many stores at once. This is the apparent shape of the supermarket fridge attacks, where a Danfoss product line was named in several countries.
• Vendor as failure: the CrowdStrike case, where no attacker was involved at all.

1. 01Know your dependencies: list the vendors whose failure would stop you, and the vendors those vendors rely on.
2. 02Stage updates: roll to a small group first, as many organisations changed their policy after July 2024.
3. 03Plan for the vendor being down: manual fallbacks, a second provider for the truly critical function, tested restore procedures.
4. 04Ask suppliers for evidence: patch cadence, access controls, incident notification terms.
5. 05Limit what each vendor can reach with least-privilege credentials, so a compromised supplier cannot walk the whole network.

Payments are a good example of a dependency worth designing for. A merchant that takes cards, bank transfers and crypto through a gateway has more than one route if one rail or provider fails. Redundancy is not exciting, but it is what keeps a store trading.

• Microsoft says 8.5M Windows devices were affected by CrowdStrike outage — TechCrunch (20 Jul 2024)
• Widespread IT outage due to CrowdStrike update — CISA
• Verizon 2025 Data Breach Investigations Report