Unforeseen downtime is imposing a financial burden of $400 billion on the world’s largest organizations each year, which is equivalent to around 9% of their profits, revealed in a recent study. This equates to approximately $9,000 lost for every moment of system failure or service deterioration.
The study, issued by the data control platform Splunk, also disclosed that it requires a span of 75 days for revenue to bounce back for a Forbes Global 2000 firm to reach its prior financial position post the occurrence.
Downtime leads directly to monetary setbacks through decreased revenue, penalties put forth by regulations, and additional wages for staff working overtime to resolve the issue. The study also brought to light concealed expenses that have a longer-term impact, such as diminished shareholder value, reduced developer productivity, and harm to reputation.
The Study on Concealed Expenses of Downtime solicited input from 2,000 executives, encompassing CFOs, CMOs, engineers, and IT and security specialists, from Global 2000 corporations across 53 countries and various sectors. They shared insights into the origin of downtime, its influence on their enterprises, and methods to mitigate it.
Root causes of downtime involve cybersecurity-linked human errors
Large corporations’ downtime incidents can be categorized into two segments: security occurrences (e.g., phishing assaults) or application or infrastructure problems (e.g., software breakdowns). According to the publication, the average Global 2000 entity encounters 466 hours of cybersecurity-related downtime and 456 hours of application or infrastructure-related downtime.
“Even though most systems have high availability, accumulated downtime across hundreds—or maybe thousands—of systems does add up,” as stated by the authors.
The top reason behind downtime occurrences, as reported by the participants, was human errors associated with cybersecurity, like falling for a phishing link. This was succeeded by ITOps-related human errors (e.g., infrastructure misconfigurations, capacity issues, and flaws in application code). It takes an average of 18 hours to detect downtime or service deterioration due to human errors, such as latency, and a further 67 to 76 hours for recovery.
VIEW: How to Thwart Phishing Attacks with Multi-Factor Authentication
Software malfunction is the third primary cause of downtime, which poses an increased risk as organizations adopt more intricate development and deployment practices. The fourth is malware incursion.
The publication disclosed that over fifty percent of executives are cognizant of the fundamental reasons for downtime within their organizations but opt not to address them. This could be due to their reluctance to heighten the technical burden of outdated systems or a strategy to decommission the problematic application. Additionally, only 42% of technology executives select to conduct a postmortem following a downtime incident to single out and alleviate the cause, given their arduous and time-consuming nature.
Immediate expenses due to downtime
Foregone revenue emerges as the primary financial implication of a downtime occurrence, averaging at $49 million each year for every Global 2000 corporation. Subsequently, the second largest expense is regulatory fines amounting to $22 million, as many regions enforce stringent regulations pertaining to downtime, such as the Digital Operational Resilience Act for the financial sector in the E.U.
Other notable cost outlays encompass the restoration of the brand’s prestige. Per CMOs, it requires an average of $14 million to execute the essential campaigns to regain brand trust, along with an additional $13 million to mend relations with the public, investors, and government entities. Approximatley 60 days are needed to fully reinstate the brand’s reputation.
In spite of recommendations from cybersecurity experts, 67% of CFOs advocate for their board of directors to satisfy the ransom demands in the event of a ransomware attack, either directly to the perpetrator, through insurance, a third party, or a combination of all three. These payouts culminate in a total annual expenditure of $19 million for Global 2000 companies.
Unseen expenses related to system downtime
Apart from the direct monetary implications of downtime, participants highlighted numerous pricey secondary consequences. For instance, 28% mentioned that an episode of downtime reduced their stakeholder value, causing an average decrease of 2.5% in stock prices. It took a mean of 79 days for a sizeable corporation’s share value to return to its previous level.
Other concealed expenses from downtime occurrences encompass delayed time-to-market and stunted innovation among developers, as indicated by 74% and 64% of respondents, respectively. The latter arises from technical squads shifting from critical tasks to applying fixes and engaging in post-event analyses. Similarly, within marketing divisions, downtime leads to remobilizing teams and budgets towards crisis management, resulting in lost productivity in other domains.
The value of a customer’s lifetime can also be influenced by downtime, according to 40% of participants, as an outage negatively affects the customer experience, consequently impacting their loyalty to the entity. Indeed, 29% of surveyed enterprises admitted losing customers as a consequence of an incident.
SEE: Lessons on Customer Interaction and IT Best Practices from the AT&T Service Disruption
Strategies for mitigating system downtime
Recommendations from resilience proponents
The report by Splunk unveiled various approaches that companies can employ to evade downtime, either because respondents found them beneficial or they were demonstrated by the top 10% of firms exhibiting resilience to downtimes.
Entities falling into the latter classification, termed “resilience proponents,” preserve $17 million more in revenue, reduce fine payments by $10 million, and save $7 million on ransomware settlements. They also recuperate from cybersecurity-related downtimes 23% faster and from application or infrastructure issues by 28% quicker than the average. Secondary costs, such as dissatisfied customer experiences, possess a reduced impact as a result.
Resilience proponents allocate more resources in particular areas in comparison to other surveyed organizations, which include:
- Defense mechanisms: $12 million extra.
- Monitoring systems: $2.4 million more.
- Added infrastructure capacity: $8 million more.
- Cyber risk assurance premiums: $11 million more.
- Data backups: $10 million more.
Generative AI can also play a role in reducing downtimes as it can provide teams with necessary data to restore operations rapidly. The report discovered that resilience proponents expand their utilization of AI features four times faster than other participants. Additionally, 74% of enterprises employing discrete AI tools and 64% embedding AI into existing systems, to tackle downtimes, found it advantageous.
Guidance from Splunk
The authors of the report also suggested methods to prevent downtimes based on their knowledge.
- Formulate a downtime strategy. Instrument every application, adhere to an outage procedure, and identify responsible engineers. Conduct simulated exercises and practice drills.
- Conduct post-event reviews. Monitoring tools streamline the process of pinpointing root causes and implementing remedies.
- Establish a precise data governance framework. Guidelines concerning intellectual property, particularly inputting into extensive language models, will protect the organization from data leaks.
- Integrate teams and tools. Collaborative groups sharing tools, data, and context will have a smoother time addressing issues, resolving the problem, and determining the source of the downtime.
- Utilize predictive analytics. Solutions driven by AI and ML can recognize trends and notify teams when downtimes are likely to happen.
“Disturbances in business operations are inevitable. When digital systems malfunction unexpectedly, companies not only face substantial revenue losses and potential regulatory penalties, but also risk damaging customer trust and reputation,” stated Gary Steele, President of Go-to-Market for Cisco and GM at Splunk, in a press release.
“How an entity reacts, adjusts, and evolves during disruptions distinguishes it as a leader. A fundamental component of a resilient organization is a unified approach to security and observability, enabling swift detection and resolution of issues across their complete digital landscape.”
About Author
