# Single Point of Everything; 4 Important Questions > Source: > Published: 2026-11-14 17:33:00+00:00 # Single Point of Everything; 4 Important Questions On Thursday, November 12, Microsoft 365, the company’s cloud suite for mail, meetings, and documents, began to fail. Outlook mail went first, and the failure spread to Teams, SharePoint, Copilot, and parts of Microsoft’s security tooling. Within about an hour, Downdetector (a site that tallies user reports of outages) had reports from [74 countries and territories](https://www.aljazeera.com/news/2026/11/13/microsoft-hit-by-global-outages-what-happened-and-why). As I write on Friday, the outage is in its second day. Unity Health Toronto [declared a “Code Grey”](https://www.cp24.com/news/canada/2026/11/12/widespread-issues-reported-with-microsoft-products-downdetector/) for loss of infrastructure. The outage reached [the NHS, the Scottish Parliament, and Police Scotland](https://www.sciencemediacentre.org/expert-reaction-to-microsoft-outage/), and it disrupted government systems in Singapore and Japan. Microsoft says there is [“no indication this is the result of malicious or cyber activity.”](https://abcnews.com/US/outlook-down-microsoft-outage-reported-mail/story?id=138088203) On Thursday afternoon (U.S. Eastern), it reported finding no recent change that matched the start of the trouble. An hour later, it was examining several configuration updates, and that evening it began reverting [a network configuration change that did match](https://www.cloudadminhub.com/microsoft-365-service-health/ex1550543/). By its account, the process that establishes secure connections was overwhelmed, and servers stopped handling requests. It has not said that the change was the cause, and it has published no root cause. We will get Microsoft’s account in time. We may never get an independent one. The Cyber Safety Review Board (CSRB), the federal panel that investigated the 2023 intrusion into this same mail service, has not met since the Department of Homeland Security [dismissed its members](https://www.securitymagazine.com/articles/101326-trump-administration-dismisses-cyber-safety-review-board-csrb) in January 2025. In the United States, the account we get will come from the party that holds the logs and made the changes. Financial regulators in [the UK](https://www.gov.uk/government/news/uk-financial-system-strengthened-with-new-safeguards-for-major-technology-providers) and [the EU](https://learn.microsoft.com/compliance/dora) now have authority to demand more from Microsoft, and Australia [invoked a resilience agreement](https://www.abc.net.au/news/2026-11-13/microsoft-outage-affects-users-worldwide/107381050) with the company this week. Whether any of them publish what they learn is an open question. My four questions below do not depend on that account. If you lead an enterprise that runs on IT, or sit on its board, ask them now. You were likely told to avoid a single point of failure. If the outage stopped your work, you built a single point of everything instead. ## 1. Are you treating this as a security problem? If your operations are degraded today, you have a security problem. In 1975, Saltzer and Schroeder’s [foundational paper on protecting information in computers](https://doi.org/10.1109/PROC.1975.9939) listed unauthorized denial of use beside unauthorized release and unauthorized modification. Their concern was the unauthorized case, but the property is the same no matter who removes it. Availability has been part of the definition of security for half a century, and it’s usually the part that gets funded last. Whether an adversary or a configuration change removed it is a matter for the post-mortem. If you are regulated, you already report availability as a risk. The question is whether the person who owns continuity and the person who owns security are working from one plan today, or two. The outage also reduced your ability to defend yourself. [Microsoft’s incident notice](https://socradar.io/blog/microsoft-outlook-outage/) listed the Defender XDR portal (the console security teams use to watch for intrusions), Safe Links (the service that checks URLs in mail before a user opens them), and parts of the admin center among the affected services. Phishing messages offering outage-related password resets appeared within hours. Your staff was ready to believe that something needed fixing, on the same day your analysts could not load their console. ## 2. Whom are you depending on? Your enterprise requires continuous access to software and services from a company with a long history of shipping flawed products. The outage began two days after November’s Patch Tuesday (Microsoft’s monthly release of security fixes), which covered [1,093 vulnerabilities](https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194). Microsoft rated 63 of them critical, and attackers were already exploiting one. The total was down from [October’s 1,413](https://www.splashtop.com/blog/patch-tuesday-november-2026), the largest on record, and up from September’s 974. No internal team can assess a thousand vulnerabilities a month, decide which matter most, and regression-test the fixes while also defending the systems not yet patched. The service’s operating record is no better. Microsoft 365 was down for [nearly ten hours](https://www.theregister.com/2026/01/23/microsoft_365_outage/) in January. An inadvertent configuration change [took down Azure Front Door](https://www.thousandeyes.com/blog/microsoft-azure-front-door-outage-analysis-october-29-2025), Microsoft’s global traffic-routing service, on October 29, 2025. A vendor’s data centers in many regions are not redundant if one configuration change reaches all of them. In June 2023, Outlook and OneDrive outages turned out to be [denial-of-service attacks](https://www.engadget.com/microsoft-confirms-june-outlook-and-onedrive-outages-were-caused-by-ddos-attacks-173431319.html). That same summer, a state-sponsored group read mailboxes in Exchange Online, the same mail service, at 22 organizations. [The CSRB concluded](https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf) that the intrusion “was preventable and should never have occurred” and that the company’s security culture required an overhaul. Microsoft answered with its [Secure Future Initiative](https://cyberscoop.com/microsoft-security-organizational-changes/). The January outage, the Azure Front Door outage, and this week’s all came after it. None of this argues for a return to the server closet. Most enterprises ran their own mail servers worse than Microsoft runs theirs. The trade was many small, independent failures for a rare one that reaches everyone at once, and few continuity plans were rewritten to match. Dan Geer and six coauthors made the monoculture argument about this vendor in 2003, in [“CyberInsecurity: The Cost of Monopoly.”](https://www.schneier.com/essays/archives/2003/09/cyberinsecurity_the.html) A German state and Denmark’s digital ministry have begun [moving off the platform](https://itsfoss.com/news/german-state-ditch-microsoft/) for sovereignty reasons; this week gave them an availability argument as well. In a forthcoming *IEEE Security & Privacy* column, [“Don’t Blame the Auditor”](https://doi.org/10.1109/MSEC.2026.3727025) (the link will resolve when the issue appears), I argue that the flood of vulnerability reports is forty years of deferred engineering coming due. The people and tools finding the flaws did not create them. In a 2019 CERIAS technical report, [“Moving to the Cloud? Points to Consider,”](https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/2019-3.pdf) I warned that moving to the cloud is not always the best idea and does not always save money over the long term. ## 3. What do your AI agents do when their vendors are unreachable? If you are integrating AI agents deeply into daily workflow, find out what happens when those agents cannot reach the vendor systems they require: the servers that check licenses, the services that run the models, and the connectors that fetch your data. This week supplied a test. Copilot went down with the rest of Microsoft 365. OpenAI and Anthropic both reported that [the connectors linking ChatGPT and Claude to Microsoft 365](https://thenextweb.com/news/microsoft-outage-outlook-teams-12-hours-global) had failed, which cut those assistants off from mail, calendars, and files. An agent whose job is to triage your inbox has nothing to do when it cannot reach the inbox. Stopping is the good outcome. Ask also what an agent halfway through a multi-step task leaves behind, and what it does with the backlog when service returns. The AI providers fail too. On September 3, ChatGPT, Claude, and Grok [all went down for hours](https://www.marketscale.com/industries/software-and-technology/chatgpt-claude-and-grok-went-down-together-and-continuity-planning-just-got-real). An [Ookla analysis of U.S. Downdetector data](https://www.ookla.com/articles/ai-platform-reliability) counted 51 instances in the first quarter of 2026 of a major AI platform drawing more than ten times its usual daily volume of trouble reports, compared with 6 a year earlier. The AI providers’ safety and security records are also poor. In July, by [OpenAI’s account](https://openai.com/index/hugging-face-incident-and-the-road-ahead/), its models under evaluation circumvented the controls meant to isolate them from the internet and compromised parts of OpenAI’s internal research infrastructure and of Hugging Face’s systems. Anthropic then reviewed its testing records and [disclosed](https://edition.cnn.com/2026/07/30/tech/anthropic-ai-models-break-out-hack) that its models had broken into three other organizations’ systems, the earliest in April. I described the pattern in [*Cyber Defense Magazine*](https://www.cyberdefensemagazine.com/newsletters/may-2026/mobile/index.html#p=108) in May: Vendors routinely release products before securing them, and security teams inherit the consequences. Adding a new dependency to an existing one lengthens the chain. Redundancy requires independence, and these services run on the same few cloud providers as everything else you depend on. ## 4. Who improvises when the tools fail? People are good at devising workarounds on the fly. They switch tools, pick up a telephone, walk down the hall, and, when necessary, revert to paper. This week, Unity Health told patients to call the main hospital line. An Australian fruit grower booking flights for seasonal workers [confirmed them by hand](https://www.abc.net.au/news/2026-11-13/microsoft-outage-affects-users-worldwide/107381050) and checked the payment with her bank. It took her three or four hours instead of one. Both workarounds were inelegant, and both worked. They also moved work onto channels nobody had vetted. People will improvise whether or not you plan for it; decide in advance which fallbacks you sanction. They worked because someone understood the purpose of the task well enough to accomplish it another way. Experienced staff carry that understanding, and no runbook contains all of it. In April, in [“New Myths for Old,”](https://www.cerias.purdue.edu/site/blog/post/new-myths-for-old) I urged readers to resist the pressure to fire the people who carry context in their heads. The claim that AI makes those people optional is false, and acting on it is expensive. In a [February 2026 Careerminds survey of 600 HR leaders](https://www.hcamag.com/ca/news/general/businesses-rush-to-rehire-staff-after-regretted-ai-driven-cuts/568293), two in three employers that had cut jobs for AI reported rehiring for the eliminated roles. The outage puts the question more pointedly. If you have replaced your highly skilled personnel with AI agents, what can those agents do when their usual tools are unavailable? As question 3 showed, the agents may be down as well. Even if they are running, they stop when they cannot reach those tools. Richard Buckland, a professor of cybercrime and cyber war at the University of New South Wales, [observed this week](https://www.abc.net.au/news/2026-11-13/microsoft-outage-affects-users-worldwide/107381050) that organizations still lack workarounds more than two years after the CrowdStrike failure of July 2024. Removing the people who would invent the workaround guarantees that the lesson stays unlearned. ## What you should start on now - List the business processes that stop when a single supplier stops. Include the AI services, and include their suppliers. - Write down the manual fallback for each item in that list, then exercise it. The exercise will show what the document missed and who supplied it. A continuity plan stored on the platform that failed is not a plan. - Establish one channel for incident coordination that does not run through the vendor whose failure you are managing. For each security control that does, decide now whether it fails open (keeps passing traffic unchecked) or closed (blocks). Find out which of your other systems send their login codes to the mailbox that is down. - Ask counsel what the contract pays for two lost days, and ask your insurer whether a vendor’s non-malicious outage is covered at all. Expect to dislike both answers. - Before the next staffing decision justified by AI, name the person who will improvise when the agents and their vendors are both offline. If you cannot name one, you have your risk assessment. Readers in European and Australian finance will recognize the first two items as existing legal obligations. This week tested whether the documents describe something your people can do. Microsoft may publish a cause eventually. You do not need it. The dependence was visible on Thursday morning. *(I used Anthropic’s Claude to help research and draft this post. The arguments and conclusions are mine.)*