Incident revealed a glaring lack of precautions CrowdStrike outage: Turning point for software engineering

Related Vendors

CrowdStrike GmbH

FAULHABER Drive Systems

dataTec AG

Wuxi InfiMotion Technology Co., Ltd.

The CrowdStrike outage on July 19, 2024, marks a pivotal moment for the software industry and has triggered a redesign of software engineering practices as well as investments in personnel, processes, and technology. This is stated in a study by Adaptavist.

The study, which surveyed 400 software developers in companies with annual revenues of over $10 million in the UK, the USA, and Germany, found that the CrowdStrike incident will prompt companies to increase their investments in software development, testing, deployment practices, and tools, augment their workforce, and expand training offerings in several areas. It also became clear that companies worldwide are evolving their software engineering and testing procedures to improve resilience and minimize associated risks—during the CrowdStrike failure, an estimated 8.5 million devices were affected.

Massive impacts show that the industry was not prepared

According to Adaptavist's surveys, the impacts of the outage were devastating: 87 percent of organizations experienced downtime, and 38 percent of companies faced severe operational disruptions lasting more than 24 hours. In Germany, this was even more pronounced: 52 percent of companies suffered from significant operational interruptions.

The incident revealed a glaring lack of preparedness. 82 percent of organizations either had no adequate emergency response plans or had no plans at all before the incident occurred. Among those with emergency plans, only 16 percent found them effective during the crisis, while 40 percent noted that their plans were inadequate for an incident of this magnitude.

Since the outage, almost half (41%) of software developers worldwide are confident that their organization can prevent a similar outage from affecting their systems in the future. However, in Germany, only 24 percent share this confidence, indicating that more needs to be done here to strengthen IT resilience.

Positive change becomes apparent

This newfound confidence is due to remarkably proactive and positive changes following the incident. The study shows that despite widespread upheaval, many industry insiders believe this had a positive impact on their companies. 74 percent or more report positive outcomes in all categories.

It is particularly noteworthy that 81 percent have implemented more robust development practices, while 80 percent report increased cybersecurity awareness among employees. The incident also triggered a complete overhaul of development practices, with 35 percent placing a greater focus on redundancy systems and 33 percent completely restructuring their software update processes.

Perhaps most surprising is that the incident actually accelerated development in many organizations. 68 percent report shortened timelines and 32 percent note a reduction in delivery times by more than a month. This acceleration, combined with more stable processes, suggests that organizations are finding more efficient ways of working while still ensuring security.

The scale of the organizations' response is reflected in substantial budget increases. 86 percent are increasing the budget for software development, and 87 percent are investing in the enhancement of team skills and technology solutions following the outage. This includes:

• 88 percent of organizations plan to increase investments in cybersecurity training.

• 86 percent plan to increase budgets for incident response training.

• 86 percent plan to increase the hiring budget, with 14 percent of companies raising their investments by more than 20 percent.

Long-term strategic realignment

The industry's commitment to a sustainable transformation is evident both in hiring plans and in the restructuring of the supply chain. A remarkable 99.5 percent of companies plan to expand their technical teams, with quality assurance leading the hiring drive (36%), followed by IT operations (34%), software developers (32%), and DevOps engineers (31%).

This realignment is leading to fundamental changes in supplier relationships. 83 percent of companies are actively diversifying their vendors or planning to do so. This shift also extends to the adoption of open source. 34 percent of companies are increasingly relying on open-source solutions, while 37 percent are strengthening partnerships with their current providers, indicating a more differentiated approach to risk management.

Jon Mort, CTO of Adaptavist, comments: "The incident with CrowdStrike was a wake-up call for the software industry. Although the impact was worrying, with 98 percent of companies affected, what is truly remarkable is how the industry has responded. We are witnessing an unprecedented transformation—from massive investments in training and new hires to fundamental changes in how companies approach development and relationships with vendors. However, the data also reveal that this transformation is far from complete. With only twelve percent of organizations having great confidence in preventing similar incidents, it is clear that we must address deeper cultural and structural challenges to build true resilience. The fact that the majority of organizations report positive fallout from this crisis suggests that, painful as it may be, this incident could prove to be the catalyst our industry needs to build more resilient, efficient, and secure systems for the future."

About the study

The study was conducted by Censuswide on behalf of Adaptavist between October 8, 2024, and October 16, 2024. Censuswide surveyed 400 individuals responsible for software development in organizations with annual revenues of $10 million or more in the UK (100 respondents), the USA (200 respondents), and Germany (100 respondents). The demographic profile of the respondents was determined by natural selection, as no reliable data to represent the national population was available. All data is based on this survey unless otherwise stated.