Crowdstrike Exposes The Cost of Digital Black Swans

The shortcomings of a centralised digital world were exposed at the end of last week with a corrupted update by a popular cybersecurity firm freezing some 8.5m Microsoft devices and causing billions of dollars in economic damage. The event has sparked debate and analysis of the incident and what it may mean in a world moving further into the digital age. ABSI this week will review the worst cyber event in history.

Nasdaq-listed cybersecurity company Crowdstrike (CRWD) wasn’t a famous name but has now become infamous when they pushed an update through their popular Falcon antivirus software which rendered ~8.5m Windows devices useless last week. The multibillion-dollar firm, with a market cap of ~US$95 billion before the outage, is known as the gold standard in antivirus software and is relied upon by most Fortune 500 companies and government agencies globally.?

Therein lies the issue, despite the cyber event only affecting 8.5m Windows devices, about 1% of Windows machines, due to Falcon’s widespread use by large enterprises running critical services, the broad economic and societal impacts were felt globally. Chaos ensued for airlines, banking, healthcare, and many other industries.

Unsurprisingly, the financial markets have hammered the Crowdstrike stock which lost ~30% of its value, some US$30 billion, in the days trading since. There are expectations for the losses to continue. While founder and CEO, George Kurtz, is in damage control with governments and major companies, the discussion is turning to compensation and what exposure Crowdstrike has to providing monetary compensation to victims. Moreover, what impact will this event have on the long-term viability of the Company’s current contracts?

“It takes 20 years to build a reputation and five minutes to ruin it.” - Warren Buffet

It is important to appreciate the need for fast updates in the cybersecurity industry. Criminals are constantly attacking networks for vulnerabilities and these threats need to be countered rapidly. This response requirement can impact the extent of testing prior to roll-out.?

Nonetheless, the event highlights the perils of a centralised digital system with a single failure point. In an ever-increasing digital world we must remember that systems can, and on a long enough time scale will, collapse at scale. More needs to be done to ensure redundancies in the system in the event of that black swan event. Something simple as every important company using the same piece of software has resulted in billions in economic loss.?

We can count ourselves lucky, in a similar vein to COVID not being as deadly as first feared but yet exposing our lack of preparedness in response to a global pandemic, this event could’ve been much worse but has yet put the spotlight on the flaws in the system. If anything is learnt it is that we have become stupidly dependent on technologies that few understand how to truly operate. I do wonder if this is the price of digital efficiency or whether analogue redundancies can be put in place to avoid future catastrophes. I don’t know, I’m just a person stupidly dependent on technologies I don’t understand.

Written by Jack Colreavy, Associate Director at Barclay Pearce Capital.