# One vendor, one update, one outage: how shared technology becomes shared risk

> The efficient way to build technology is to share it: one operating system, one security product, one cloud, one controller vendor. The efficient way is also how a single mistake or a single compromise reaches a million machines. This piece is about the weakness we built ourselves.

Updated 2026-11-03 · Payaries · https://www.payaries.com/blog/concentration-risk-one-vendor-one-update-one-outage

## An outage with no attacker

> **Written 3 November 2026.** Payaries is a technology platform, not a security adviser. This article reports public information and is not legal or security-consulting advice. Facts in fast-moving stories change — read the primary sources linked below.

On 19 July 2024 a faulty software update from the security company CrowdStrike crashed Windows computers around the world. Microsoft estimated 8.5 million devices were affected, under 1% of all Windows machines, per its own blog post, yet the effect was out of proportion because those machines were concentrated in airlines, hospitals, banks and broadcasters. Published estimates of the financial damage run to at least US$10 billion. There was no attack, only a bad update to a tool installed to prevent attacks.

It matters because it showed the blast radius of a mistake. An attacker who finds the same lever does not need to hack a thousand companies; they need to hack the one they share.

## The third-party problem

Verizon's 2025 Data Breach Investigations Report analysed more than 22,000 security incidents, including 12,195 confirmed breaches, and found that **the share of breaches involving a third party doubled from 15% to 30%** in a year. Vulnerability exploitation, particularly in edge devices and VPNs, also rose. Every business now depends on its suppliers' security, and often cannot see it.

- **Vendor as door:** attackers reach many customers by compromising one supplier or tool (the pattern behind the 2025 grocery-distributor incidents in [retail](https://www.payaries.com/blog/retail-cyberattacks-ms-coop-jaguar-land-rover)).
- **Vendor as blast radius:** a common controller or product means one flaw affects many stores at once. This is the apparent shape of the [supermarket fridge attacks](https://www.payaries.com/blog/supermarket-fridge-cyberattacks-europe-2026), where a Danfoss product line was named in several countries.
- **Vendor as failure:** the CrowdStrike case, where no attacker was involved at all.

## What reduces it

1. Know your dependencies: list the vendors whose failure would stop you, and the vendors those vendors rely on.
2. Stage updates: roll to a small group first, as many organisations changed their policy after July 2024.
3. Plan for the vendor being down: manual fallbacks, a second provider for the truly critical function, tested restore procedures.
4. Ask suppliers for evidence: patch cadence, access controls, incident notification terms.
5. Limit what each vendor can reach with least-privilege credentials, so a compromised supplier cannot walk the whole network.

Payments are a good example of a dependency worth designing for. A merchant that takes cards, bank transfers and [crypto through a gateway](https://www.payaries.com/guides/how-a-crypto-payment-gateway-works) has more than one route if one rail or provider fails. Redundancy is not exciting, but it is what keeps a store trading.

## Sources

- [Microsoft says 8.5M Windows devices were affected by CrowdStrike outage — TechCrunch (20 Jul 2024)](https://techcrunch.com/2024/07/20/microsoft-says-8.5m-windows-devices-were-affected-by-crowdstrike-outage)
- [Widespread IT outage due to CrowdStrike update — CISA](https://cisa.gov/news-events/alerts/2024/07/19/widespread-it-outage-due-crowdstrike-update)
- [Verizon 2025 Data Breach Investigations Report](https://verizon.com/about/news/2025-data-breach-investigations-report)

## Questions

**What caused the CrowdStrike outage?**
A faulty software update from CrowdStrike on 19 July 2024 crashed Windows machines running its security sensor. It was not a cyberattack. Microsoft estimated 8.5 million devices were affected.

**What is concentration risk in technology?**
The risk that many organisations depend on the same vendor, product or cloud, so one failure or compromise affects all of them at once.

**How common are third-party breaches?**
Verizon's 2025 report found third-party involvement in 30% of breaches it analysed, double the 15% of the year before.

## Try it

Run a real invoice before you commit: [Payaries — www.payaries.com](https://www.payaries.com/signup). Payaries is a multi-chain crypto payment gateway — https://www.payaries.com

## Keep reading

- https://www.payaries.com/blog/retail-cyberattacks-ms-coop-jaguar-land-rover — Shelves, showrooms and assembly lines: what the M&S, Co-op and Jaguar Land Rover attacks taught us
- https://www.payaries.com/blog/supermarket-fridge-cyberattacks-europe-2026 — Someone is hacking supermarket fridges: what we know about the attacks across Europe
- https://www.payaries.com/blog/how-to-defend-against-cyberattacks-what-works — How to defend against cyberattacks: the checklist that matches how attacks actually happen
- https://www.payaries.com/guides/how-a-crypto-payment-gateway-works — How a crypto payment gateway works, from invoice to settlement