Cloud outages: concentration risk with a public post-mortem

Almost never the servers. Modern outages of consequence are failures of the systems that coordinate infrastructure rather than of the infrastructure itself - the naming layer that tells services where to find each other, the configuration distribution that pushes settings everywhere at once, the identity layer that decides who may do what. Those are single logical systems even when the hardware beneath them is spread across continents.

That is why a fault propagates the way it does. In October 2025 a naming problem in one AWS database service in a single region cascaded into compute and storage services and from there into consumer applications, producing a disruption lasting about fifteen hours. Nothing was destroyed and no attacker was involved; a dependency that everything else assumed was reliable stopped answering.

The same shape recurs across providers. Azure suffered a global disruption from a configuration change in its content delivery layer, affecting productivity software, communication tools and even airline operations. Cloudflare had two separate global outages within a single month in late 2025. Different companies, different technologies, one pattern: a change to a central control system, applied everywhere, faster than anyone could evaluate it.

Because it is publicly observable in real time by anyone, which is rare in this domain. A breach is known to the attacker and the victim long before anyone else; an outage is known to millions of users the moment it starts. That symmetry removes the informational asymmetry that makes most security markets uncomfortable.

Because the artefacts are unusually good. Providers run public status pages that record incident start and end times, and the major ones publish detailed technical post-mortems afterwards - Cloudflare's are published on its own engineering blog and describe the mechanism in specific terms. A contract can name a status page for the duration and a post-mortem for the cause.

And because the consequence is contractual as well as reputational. Service level agreements specify credits when availability falls below a threshold, so a duration is not merely a fact but a financial trigger. That gives an outage a defined quantitative dimension that most incidents in this domain lack entirely.

Status pages are the operative source and they have a known bias: they are written by the party whose availability is being measured. Incident start times tend to be recorded from confirmation rather than from first impact, and scope is described in terms of the provider's own service boundaries rather than the user's experience. Both push measured duration downward relative to what users experienced.

Post-mortems are the more honest document, and among major infrastructure providers they are genuinely good - specific about mechanism, timeline and remediation in a way most corporate incident communication is not. They arrive days to weeks later, which makes them useless for a duration contract and essential for a cause contract.

Third-party monitoring fills the gap between the two. Independent observability services record reachability from many locations continuously, and their data frequently shows impact beginning before the status page acknowledges it. A contract that names third-party monitoring rather than the provider's own page is measuring a different and usually longer event.