In this presentation, the speaker analyzes the massive CrowdStrike outage—affecting over 8 million devices and costing more than $5 billion—to extract three strategic actions that CEOs, CIOs, and board members should implement to strengthen organizational resilience. First, they must reassess third‑party and vendor risk by reviewing contracts, SLAs, licensing agreements, and establishing clear vendor‑selection criteria (reputation, certifications, insurance, security practices) while documenting configuration settings and acceptable parameters. Second, they should enhance crisis‑management preparedness by updating and rigorously testing disaster‑recovery, business‑continuity, and communication plans, identifying single points of failure, streamlining decision‑making, and coordinating external partners such as PR, legal, and forensics teams. Third, they must verify and improve product quality‑assurance processes, ensuring robust QA policies, clear roles, exception handling, and testing of all code and telemetry before it reaches customers, avoiding the misuse of customer production environments as test beds. The speaker emphasizes proactive, documented, and cross‑functional approaches to protect investors, maintain trust, and prevent future high‑impact outages, concluding with a call to subscribe and seek tailored advisory support.
Chapters
The CrowdStrike outage, which impacted over 8 million computers at a cost exceeding $5 billion, was a crushing incident for organizations across the globe. But it also stands as an opportunity for businesses of all sizes to learn important improvements to avoid or minimize impacts from disruptive incidents. CEOs, CIOs, and board members have a clear responsibility to protect the business and the investors. Realizing the growing risks, adapting to rising expectations, and shaping the organization to be more resistant and resilient to detrimental disruptive events are crucial to success. These are the area that the recent outage has highlighted to address. So let's look at the top 3 actions business leaders must do. First, reassess third-party risks. The goal is to avoid impacts by recognizing risks and making good business decisions. So we want to review the agreements and contracts with your vendors, including the end-user licensing agreements, the service level agreements, and any agreements stated in the legal contracts. We want to understand who is liable for outages, bad software, operational mistakes, and this would probably be a really good time to understand what changes may be needed to be negotiated in the future and what risks you will carry until that point in time. Many unfortunate situations are outside of your direct control and in the hands of those third parties, which is It is crucial to make sure you are selecting your vendors, well, who are trustworthy. To be consistent, the criteria for trust, whatever it is for you, right, it must be established as part of the vendor selection process. Decide and document what may disqualify a vendor. Look at things like reputation, certifications, uh, what insurance they carry, the history they have as a business, uh, developmental and operational processes, management maturity, and of course cybersecurity practices. For the applications and services you currently depend upon, conduct an analysis to evaluate the current or default settings, uh, whichever you're using, And these may reveal unacceptable risks for security, privacy, safety, and reliability. So get the right people in your organization to take a look at those aspects, aspects, so that they can bring their knowledge to bear to understand what those risks are. And these should be evaluated and either remediated or accepted, and then tracked by the right authoritative parties within your organization. Now, documenting the configuration and allowable settings in a policy procedure or some other kind of document is a good way to make sure future systems remain consistently within the acceptable setting parameters. And that could be when you either upgrade to a new piece of software or a different service, or you change vendors. Or you bring in something similar. Either way, having it documented will maintain that consistency, and you can feel confident that you're not gonna have some unusual surprises because of poor change management. Okay, the second thing we need to do is enhance your crisis management preparedness. When something does go wrong, and eventually it will, the objective is to minimize the loss. The best way to succeed is to employ a well-tuned response and resilience capability. Being proactive in building and testing crisis preparedness like this is hugely advantageous, while waiting until a crisis occurs to test those capabilities often leads to unfavorable decisions, detrimental surprises, avoidable mistakes, and lengthy delays. So prepare or update a crisis management plan and be sure to robustly test the people, the processes, and the tools. Enable by design for these teams to be empowered to act in really smart ways in a timely manner. We don't want to have too many layers of bureaucracy that could slow them down because that could make all the difference in the world. And make sure the disaster recovery and business continuity plans, the communication processes, teams, tools, and necessary outside vendors are well prepared to work together. You may be bringing in a PR firm or a legal firm or a cybersecurity expert or cybersecurity forensics teams. Make sure you know how to get a hold of them, they know your processes, and you can hit the ground running. Having playbook actions ready to assess, decide, act, and document activities is also hugely helpful in getting everything rolling and getting your best foot forward. We also want to identify what are called single points of failure. And when we look at our digital systems, our processes, our engagements with external parties, It's really important to understand if that one piece fails and there's no backup, there's no failover, it's just that one element. If it fails, everything goes downhill, right? So we have to identify those. And these represent vulnerable areas that should be disproportionately protected and monitored for rapid alerting if something does go awry. Have recovery options prepared. And lastly, we have to strengthen the cooperation between the information technology team and the cybersecurity department. If there's a cyberattack, these teams must work closely to contain and evict the attacker. They must know each other's world very well and work together as a well-oiled team. Okay, the third thing that we need to learn from is to verify the quality assurance of company products. Nobody wants to be the next CrowdStrike. So proper quality assurance, or QA, is needed to ensure that your products or services don't create cascading failures with your customers and your partners. So first, we have to verify the actual existence of a proper product QA capability, and this includes the policies, tools, processes, and the empowered leadership as part of that team and overall process. There are well-documented QA structures that lend themselves to delivering products that operate as intended. Are difficult to misuse, and are vetted to not cause undesired impacts to customers. So look and figure out what's best for you, but you need to make sure you've got something that fits your organization, that meets your overall goals, okay? People and their behaviors play a big role in the consistency and comprehensiveness of Product quality assurance. So we have to pay attention here. Clear roles and responsibilities are absolutely needed, and there should never be any ad hoc workarounds to the QA process. If extreme circumstances present themselves, a clear and accountable exception process should be followed for transparency, traceability, and accountability. That way we all know what the problems are, when it's gonna be fixed, what that window of vulnerability is, and everybody's okay with it. But we have to follow through. And lastly, the scope of what is evaluated as part of that Q&A process is very, very important. You have to validate that both your major revision releases and any operational bi-direction, uh, data or telemetry are also covered by your quality assurance practices. This is where CrowdStrike failed. Remember, any code or data going to customers should be properly tested before it lands in the customer environment. Using your customer's production network as your test environment is a recipe for disaster. The downtime resulting from the CrowdStrike outage has highlighted the need to manage product quality and be able to recover when events disrupt critical business functions. Senior leadership should learn from the painful lessons and apply knowledge to avoid or minimize serious impacts and not be the cause of a newsworthy outage across their customers. So let's all adapt and make our interconnected digital ecosystems more trustworthy. For more cybersecurity, privacy, safety, and reliability insights, be sure to subscribe If you need a more tailored advice and custom support specific to your organization, such as an advisor on retainer, don't hesitate to reach out. Thank you much. See you next time.
