2024 — The Year in Outages, and What It Taught Us

Every year has outages. 2024 had lessons — delivered at a scale nobody could ignore, in two acts: a supply-chain attack that turned a trusted CDN against a hundred thousand websites in June, and a single bad file that blue-screened millions of Windows machines in July, grounding planes and freezing hospital systems. Around those headline events ran a steady hum of cloud and SaaS wobbles — the routine reminders that everything is someone else's computer now.

As the year winds down, it's worth reading the incidents together, because they rhyme. Here's what 2024 broke, why the failures look so similar, and what a small team should actually carry into 2025.

July: CrowdStrike, or one file versus eight and a half million machines

The defining incident of the year — plausibly of the decade — arrived on Friday, July 19. A malformed Falcon sensor "channel file" update from CrowdStrike sent an estimated 8.5 million Windows machines into blue-screen boot loops. Airlines cancelled thousands of flights, hospitals postponed procedures, banks and broadcasters and point-of-sale systems went dark — and recovery required, in many cases, a human being at each individual machine, complicated everywhere by BitLocker recovery keys locked inside systems that were themselves down.

What made it a lesson rather than just a disaster was the mechanism. Not a cyberattack — a release process. The channel file went out to essentially the whole fleet at once because it was classified as content rather than code, exempt from the staged rollouts the sensor software itself got. A kernel-level agent, universal automatic distribution, no canary stage: each choice defensible, the combination historic. We wrote up the full anatomy and takeaways in our post that week.

June: polyfill.io, or the supply chain turning quietly hostile

A month earlier, the year's other signature incident unfolded in slow motion. The polyfill.io domain — a CDN embedded in, by some estimates, over 100,000 websites — had been sold in February to an obscure company called Funnull. In late June, researchers caught the service injecting malicious redirect code into the polyfills it served, tuned to fire selectively (mobile devices, certain hours) and to hide from site owners and analytics. Cloudflare and Fastly stood up clean mirrors; the domain was ultimately taken down at the registrar level; and hundreds of thousands of script tags pointing at a hostile hostname had to be found and removed by hand.

No servers were breached. The attack was a purchase — trusted infrastructure changing owners, then changing behavior. Every <script src> pointing at a third-party domain is a standing grant of full code execution to whoever controls that name, forever. June was the year's reminder of what "whoever" can come to mean; our post from that week has the defenses — inventory, self-hosting, SRI, CSP, change detection.

And throughout: the steady hum of cloud and SaaS wobbles

Beyond the two headliners, 2024 delivered its regular cadence of shorter, sharper reminders: major cloud regions having bad days, big SaaS platforms — the tools teams run their whole workflow on — going dark for hours at a stretch, CDN hiccups briefly taking down swaths of sites at once. None individually historic; collectively, a drumbeat with one message. Modern stacks concentrate risk in a handful of shared providers, and when one stumbles, thousands of businesses discover simultaneously that "their" outage was never theirs to prevent — only theirs to detect, communicate and ride out.

The common threads

Line the year's incidents up and three patterns fall out:

• Change management failure. CrowdStrike was a bad change shipped everywhere at once. A striking share of the year's cloud incidents trace to the same shape — a config push, a deployment, an update that skipped the gradual path. Almost nothing broke this year by standing still; things broke because a change went out faster than the blast radius deserved.
• Third-party concentration risk. Polyfill.io was a dependency turning hostile; CrowdStrike was a dependency failing catastrophically; the cloud wobbles were dependencies simply having outages. Different failure modes, one lesson: your availability is the product of every vendor you've coupled to, most of which you've never listed.
• Communication quality as the differentiator. Within every shared incident this year, affected companies experienced the same root cause — but their customers experienced wildly different incidents. The teams that posted early, updated often and admitted uncertainty came out with trust intact; the ones with silent status pages and green dashboards over broken services did lasting damage. Comms didn't change what broke. It changed what the outage cost.

What small teams should take into 2025

You don't run a global cloud, but every 2024 lesson scales down to a team of two:

• Stage your rollouts — including "just config." Deploy to a canary slice, watch real signals, then widen. If changing a file can change behavior, it deserves the same discipline as code, whatever it's labeled. And make rollback a one-command reflex.
• Build a dependency inventory. One page: every third-party script in your pages, every agent on your machines, every API in your money path, every SaaS your workflow dies without. You can't assess concentration risk you haven't written down — and both June and July punished the unlisted.
• Monitor from outside your own stack. A theme of the year's worst days: internal monitoring failing with the thing it watched, teams learning their scope from social media. Independent, external checks are your ground truth on what users actually experience — regardless of which vendor is having the bad day.
• Build incident comms muscle memory. A status page that exists before the incident, templates pre-written, and the habit of posting "we know, we're on it" within minutes. In 2024, that discipline was worth more than an extra nine.

Onward to 2025

If 2024 had a thesis, it's that resilience is no longer mostly about your own servers — it's about how you manage change, how well you know your dependencies, and how you behave in the hour after something breaks. All four takeaways above are process, not headcount, and a small team can have them in place by January. CompleteStatus covers the tooling half in one dashboard: independent external monitoring for uptime, APIs, SSL and DNS, change detection for the polyfill-shaped risks, and hosted status pages so your comms have somewhere to live before you need them. Start free — and here's to a quieter 2025.