Whether arising from a cyber attack or another form of disruption, a 24-hour outage affecting major Amazon Web Services (AWS) or Microsoft Azure cloud regions in the UK, Ireland, Europe or the eastern US could trigger major economic disruption across the UK, causing direct revenue losses of between £650m and £1bn, with downstream costs likely to rise significantly, according to a report from the UK’s Cyber Monitoring Centre (CMC).
The CMC worked with cyber insurance supplier Parametrix on the report, The cost of downtime: UK exposure to cloud infrastructure failure, which was compiled to help support the CMC’s core mission of assessing and detailing the financial impact of major cyber events.
The report identified that while only 11% of UK companies were “cloud-dependent” for critical functions, this figure rose to 64% when weighted by revenue and over 80% across the FTSE 100 group of organisations, meaning cloud outages disproportionately affect some of the nation’s most economically important companies.
It described 80% of all UK organisations as being “dependent” to some degree on either AWS, Google Cloud Platform or Microsoft Azure services, with exposure across the FTSE 100 spread roughly 50/50 between cloud regions located in the UK and Ireland and those located elsewhere. Naturally, the largest organisations were found to have the greatest geographic distribution of cloud risk. AWS us-east-1, AWS eu-west-1, and Azure northeurope/westeurope had the greatest exposure.
“This paper has been developed at an important stage in the UK’s adoption of cloud computing. Nearly 80% of companies in the UK with more than £50m of revenue are reliant on cloud infrastructure, and many of these use the cloud for business-critical operations,” said CMC CEO Will Mayes.
“Mapping out cloud data usage provides a valuable starting point for the CMC’s analysis of future cloud failure events. Actual losses would likely end up being significantly higher when accounting for the knock-on impacts to customers of cloud users, and this will be an important element of our analysis if a major cloud outage occurs.
“The findings reveal a UK economy which is increasingly dependent on cloud infrastructure, with exposure concentrated at a small number of critical aggregation points. This concentration creates systemic vulnerabilities that require coordinated action from companies, insurers, regulators and policymakers to manage effectively. This isn’t about stepping back from the cloud; it’s about recognising that cloud is now part of our critical infrastructure, and designing, governing and investing accordingly,” Mayes concluded.
Healthcare, IT and tech in the crosshairs
The CMC and Parametrix said that among the largest FTSE 100 companies, cloud dependency was highest in healthcare, and software and IT services, followed by financial services and transportation.
Sectors such as manufacturing, retail and wholesale were found to be less exposed. However, given their economic weight, these industries still represent a significant problem for the wider economy should their operations be disrupted.
The CMC and Parametrix said organisations must work to quantify their cloud exposure and potential financial impact, and warned that too many still lacked visibility into their various dependencies and exposures.
Complicating this necessary work, however, is the undeniable fact that effective risk management in this area will require coordinated action across stakeholders, since the systemic nature of cloud dependencies will – should a major outage occur – cascade rapidly.
Managing the risk effectively will require user organisations to build more robust architectures, policymakers to ensure regulatory frameworks are keeping pace, and the insurance industry to price and cover such risk appropriately.
“Cloud services have become one of the most important layers of critical infrastructure, yet most organisations have only a limited understanding of where their dependencies actually lie,” said Sharon Haran, chief commercial officer at Parametrix.
“You can’t manage, monitor, or transfer a risk that you haven’t first identified and quantified. We’re proud to partner with the Cyber Monitoring Centre on this analysis, which gives UK businesses a clearer picture of where cloud exposure is concentrated and what a major outage could mean for both individual organisations and the UK economy.”
