By Robert Keblusek, Sentinel’s Chief Innovation and Technology Officer

When the best-funded cloud in the world goes dark

Starting Thursday morning, Microsoft 365 went down for organizations around the world, and it stayed down or degraded for roughly a full day. Microsoft opened incident EX1550543 for Exchange Online at 16:17 UTC on November 12 (CX Today), then a second incident, MO1550821, as the problem spread to Teams, SharePoint, Copilot and Defender XDR (SecurityWeek). Outlook problem reports on Downdetector peaked near 140,000, from at least 74 countries (CX Today). It took until late Friday morning U.S. time for Microsoft to report it had addressed the underlying issue and that email queues were approaching normal levels (TechRadar).

The damage went well past email. In the U.K., NHS England fell back to paper records and police could not take online crime reports. Microsoft's own Dynamics 365 Contact Center was down for nearly eight hours, leaving agents unable to take calls or messages, and both OpenAI and Anthropic reported problems with the connectors their AI tools use to reach Microsoft accounts (CX Today). Microsoft says the cause was a technical issue in its own infrastructure, traced to an earlier network capacity upgrade, with no sign of an attack (TechRadar). It stretched Exchange's message timeout window to 48 hours so delayed mail would still be delivered (CX Today).

For me, the lesson starts with who went down. This is Microsoft, one of the best-run, best-funded and most redundant cloud operations on the planet. If Microsoft can lose a full day, every other provider you depend on can too. This week it was email. Next time it could be your ERP, your EHR, or the quoting tool your sales team lives in, and the question will be the same: what happens to your business when a critical application, SaaS or on-premises, stops working?

"It's in the cloud" is where planning tends to stop

SaaS has been taking over more of the business for years, and for good reason. It took servers, patching and upgrades off the to-do list. Along the way it also took away a habit that used to be automatic: asking, "What do we do when this is down?"

Too many organizations assume the provider has it covered. Read the contract. A SaaS provider's obligations end at its own platform, and the remedy for missed uptime is usually a service credit. A service credit won't cover a lost week of billing, a missed shipment, or a customer who walks.

Keeping your business running through the largest and longest outages is your responsibility, and that covers every application the business depends on:

• SaaS platforms: ERP, CRM, EHR, ticketing and ITSM, quoting and CPQ, contact center, HR and payroll
• On-premises systems: line-of-business applications, file services, identity, manufacturing and operational technology
• Everything that ties them together: identity providers, integrations, APIs and the AI tools now wired into all of the above

We see these gaps all the time in the assessments Sentinel performs for customers. As Mark Combs, National Director of Enterprise Architecture and Innovation, wrote in What Hundreds of Security Assessments Taught Me About the Hidden Cost of "It's Deployed", what we often fail to find tells us as much as what we do find: a current business continuity plan, a recent business impact analysis, tested recovery time and recovery point objectives, and proof that backups can be restored after ransomware.

Your customers will forgive Microsoft. They may not forgive you.

Microsoft owned this one publicly. Charles Lamanna, Microsoft's Executive Vice President of Copilot, Agents and Platform, posted that "We regret that today's outages caused disruptions for our customers, and we are working to address the issue" (Windows Latest). I'm sure they feel terrible about it. They also know, as every one of their customers knows, that nobody is leaving Microsoft over this.

When a household name goes down worldwide, almost everyone is affected at once, your competitors included. If you serve other businesses, your customers were likely fighting the same fire this week, and they gave you a pass because everyone was down.

Now picture a different event. The quoting platform, contact-center service, or niche workflow tool you rely on to deliver your service fails, and only your organization is affected. Your competitors keep shipping, answering and billing. Your customers see a supplier who couldn't deliver, with no headline to explain it.

	Global outage of a known provider	Outage of a less common SaaS or on-prem system
Who is affected	Nearly everyone, including your competitors	You and a handful of others
What customers see	A headline they are living through too	Your failure to deliver
Customer tolerance	Higher: "everyone was down"	Lower: "why couldn't they deliver?"
Business risk	Delay and catch-up work	Churn, lost deals and a reputation for unreliability

The businesses you serve are buying an outcome: your delivered service. They have no interest in which provider in your stack failed. An isolated outage is far harder to forgive than a worldwide one, and it can quickly turn into churned customers and a reputation as the less reliable choice. If you got through this week without a continuity plan, you were lucky everyone else was down too. Next time, your customers might just leave you over it.

That is why continuity planning has to include reputation management and customer communication. Decide in advance who tells customers what, how quickly and through which channel, keeping in mind that your primary email and collaboration tools may be down too. Be ready to answer the question every customer will ask afterward: can you prove this won't happen again?

Outages don't announce their cause in advance

Microsoft says this week's event was a technical failure. Plan for every way a critical application can disappear:

• Cyberattack. Ransomware or a breach at your provider can take a platform offline for days, weeks or months, with no guarantee your data comes back intact.
• Operational error. A bad configuration change or update can cascade across a provider's infrastructure. Microsoft traced this week's outage to a network change, and in 2024 one faulty CrowdStrike update knocked systems offline around the world (Sentinel: Lessons Learned from the CrowdStrike Outage).
• AI agents acting on their own. Autonomous agents now have access to production systems, and they can take actions no one approved. In April 2026, an AI coding agent at PocketOS, a software provider to car rental businesses, deleted the company's production database and its backups with a single API call in about nine seconds (Computing). The backups sat on the same storage volume as the data they protected, so one action destroyed both (TechSpot).
• Provider failure. A financially weaker vendor can go out of business. A small, innovative company can be acquired and its product shut down. Either way, your data may be stranded.

I would spend extra time on that last one. Many organizations run critical workflows on small, innovative providers that do one thing extremely well. These vendors are often younger, smaller and less funded than Microsoft, Oracle or ServiceNow. If one of them is hit by ransomware, sold or shut down, where is your data, and can you use it?

After Mythos, the odds are getting worse

These events are likely to come faster. In April 2026, Anthropic launched Project Glasswing, giving a small group of partners, including AWS, Apple, Cisco, CrowdStrike, Google and Microsoft, access to its unreleased Claude Mythos Preview model for defensive security work (Help Net Security). Anthropic kept the model restricted because, by its own account, no company has built safeguards strong enough to prevent models like it from being misused (Engadget). By late May, Anthropic reported that the effort had turned up more than 10,000 high- or critical-severity vulnerabilities. Anthropic and six independent security firms reviewed 1,752 of those findings and confirmed more than 90% were real (Help Net Security).

Finding flaws has become far easier than fixing them. The Cloud Security Alliance found that of 1,596 vulnerabilities disclosed to open-source maintainers by late May, only 97 had confirmed patches, about 6% (Cloud Security Alliance). As we told attendees at Sentinel's Prove It Before Attackers Do briefing, AI shrinks the time between discovery and exploitation, while defensive change windows still move at enterprise speed.

Apply that to your SaaS stack. Glasswing started with about a dozen launch partners and grew to roughly 200 organizations within about two months (SC Media). Most software providers in the world were never part of it, including most of the niche, mid-sized and startup SaaS vendors businesses rely on every day. Those providers face machine-speed attackers with human-speed patching, and their customers inherit that risk whether they see it or not.

Three questions every leader should be able to answer

For each application your business can't operate without, SaaS or on-premises, ask:

1. Do we have a usable copy of our data, in a format a backup system can restore? That means a current, protected, immutable copy outside the provider's own environment, with a restore someone has actually tested. An export someone ran once and saved to a laptop falls short.
2. Do we have a usable copy we could migrate to a new provider? If one of your vendors suddenly disappears, perhaps due to an acquisition and sunset or an inability to recover from ransomware, could you stand up a replacement with your records, history, and configurations intact in a useful format?
3. How does our business run "on paper" while the system is down? Who takes orders, answers customers, dispatches work, bills and pays people for two days? For a week? For a month?

Now do the math. Divide your annual revenue by roughly 250 working days. That is about what a single day without a critical system can cost, before you count churn, penalties, and damage to your reputation. If you serve other businesses, multiply the impact by every customer who depends on you to deliver.

Build the plan, then prove it works

A continuity binder on a shelf or in a SharePoint site you can't reach during a Microsoft outage won't help anyone on the day it matters. A real program is built, tested, and repeated:

1. Map critical services and their dependencies. Inventory every SaaS and on-premises application in your delivery chain, including the small ones that perform one critical function.
2. Run a business impact analysis. Set recovery time and recovery point objectives for each business process, starting with the ones that bring in revenue.
3. Back up beyond email. Protect SaaS and on-premises data with immutable copies stored outside the provider and out of reach of an over-permissioned AI agent or attacker.
4. Assess vendor stability. Weigh each provider's financial health, security maturity, and exit terms. Know how you would leave before you need to.
5. Write manual workarounds. Document how each department operates when a system is unavailable, and keep those procedures accessible offline.
6. Plan your communications. Prepare out-of-band channels and customer messaging, including the reputation management an isolated outage will demand.
7. Test it, then test it again. Run tabletop exercises and live recovery tests. The test that matters is whether the business can operate for several days without a critical system.

As our team noted after CrowdStrike, this does not have to be difficult or expensive. A few low-cost, strategic investments can turn a crisis into little more than a hiccup. Sentinel's Resiliency & Recovery solutions provide automated, immutable backup that integrates with nearly every cloud platform, with recovery workflows that restore anything from a single file to an entire environment.

Request a Sentinel Business Resilience Workshop

There will be a next outage. What matters is whether your business keeps delivering when it happens.

Sentinel's Business Resilience Workshop is led by an IT executive with more than 25 years of director- and CIO-level experience. Together we will:

• Analyze staff and external communication processes during a disruption
• Identify missing continuity plans across business and department management
• Assess the impact of a disruption on each department
• Confirm employees can connect and work from anywhere
• Deliver recommendations aligned to your strategic goals, with an overall risk score and a Business Resilience Readiness rating

The workshop examines your resilience across five pillars: operational, strategic, financial, social and organizational. From there, Sentinel can help you build and test the plan, protect your SaaS and on-premises data, and continuously validate that your recovery works.

Don't wait for the next outage to find out what your providers didn't cover. Contact your Sentinel Account Manager, email [email protected] or call 1.800.769.4343 to schedule your Business Resilience Workshop. For an active cyberattack or ransomware situation, call Sentinel's Incident Response Emergency line at 1.800.297.4853.