TECHNOLOGY CONCENTRATION / SERVICE DESIGN
A strong supplier
can still be a dependency.
Review common failure paths without turning a historic outage into an automatic instruction to buy more products.
A supplier can retain strong commercial performance while its customers experience severe disruption. Those outcomes measure different things, and a resilience decision should examine both.
CrowdStrike’s August 2024 results sharpened the discussion about technology diversification. Shared dependencies deserve examination; vendor count alone does not establish resilience.
THE EXECUTIVE BRIEF
The decisions that matter.
- Keep the financial results tied to their reporting period.
- Do not infer that revenue growth proves an incident had no impact or that the supplier would make no changes.
- Compare concentration with the cost and complexity of genuinely independent alternatives.
THE ORIGINAL RESULTS / AUGUST 2024
Commercial resilience is not customer continuity.
CrowdStrike’s fiscal Q2 2025 release reported $963.9m revenue, up 32%, for the quarter ended 31 July 2024. The 19 July incident occurred near the end of that period. The release and contemporaneous reporting also discussed the effect on outlook and deals.
These dated results cannot show the full long-term effect of an incident that occurred near quarter-end. They do not prove market share was unchanged, customers bore every loss, or the company had no incentive to improve.
A critical question follows: what happens to the customer’s important services if a widely used supplier or update mechanism fails? That is an architectural and operational question, not a stock-market verdict.
THE CONCENTRATION REVIEW
Different labels do not necessarily mean different failure paths.
A TECHNOLOGY PORTFOLIO REVIEW
Ask what is actually independent.
COMMON CAUSE
What can fail together?
Look for shared identity, update mechanisms, cloud infrastructure, management tools, and critical specialist support.
ALTERNATIVE
What keeps the service usable?
Establish whether a second route can operate without the failed dependency and with the required data and authority.
OVERHEAD
What new work does diversity create?
Include integration, skills, monitoring, licensing, changes, and recovery coordination in the decision.
CyberSolace review lenses. More products are not automatically safer; the aim is a workable service under defined failure conditions.
A multi-vendor design can reduce a specific concentration while adding configuration and monitoring complexity. A consolidated design can simplify operations while concentrating some risks. Compare the actual scenario and controls rather than choosing a slogan.
Identify the service that matters first. The relevant alternative might be an independent recovery path, a tested manual service, or a different support arrangement, rather than a second copy of every tool.
WHAT TO ASK A SUPPLIER
Bring change and recovery evidence into the contract discussion.
- How are changes tested, staged, monitored, and reversed where reversal is possible?
- Which functions can the customer control and which depend on the supplier’s release process?
- How will authenticated incident guidance reach the customer during an outage?
- What evidence supports recovery, and which dependencies or limitations remain?
Ask for answers applicable to the service and configuration being purchased. A general assurance report or availability statement may not describe a particular update channel, endpoint failure, or customer recovery responsibility.
DIVERSIFY WITH A PURPOSE
Protect the ability to change as well as the ability to operate.
Technology audits, interoperability, contract review, and staff capability are practical when connected to a service owner and a decision. An inventory should expose consequential concentration, not simply count supplier names.
Before relying on an alternative, test the transfer of data, access, and operating responsibility. Open formats and documented interfaces can help, but a nominal export feature is not proof that another system can use the data or that the business can tolerate the transition.
Budget for the people who will maintain the arrangement. Diversity that cannot be kept patched, configured, or understood may undermine the resilience it was intended to create.
A PRACTICAL NEXT STEP
Choose one dependency whose failure would interrupt a service.
CyberSolace can help compare concentration, alternatives, and operating complexity using a defined business scenario.
SOURCES & EDITORIAL REVIEW
Historical findings and incident accounts are dated in the text. Illustrative review prompts are CyberSolace commentary. Editorial review: 20 October 2026.