In July 2024, one defective CrowdStrike update caused a global IT outage that disrupted hospitals, airlines, banks, and businesses. The incident showed how a relatively small problem can have enormous consequences when multiple processes fail.
More than two years later, we can revisit the incident to see what changes CrowdStrike made to address the causes of the outage.
On July 19, 2024, CrowdStrike released a defective configuration update to its Falcon security software. The update caused millions of Windows computers to crash. CrowdStrike corrected the update within about 80 minutes, but many affected computers required manual intervention to restore, leaving organizations facing extended outages.
In our original analysis of the CrowdStrike outage, we found that the problem wasn't simply a defective file. Breakdowns in development, quality assurance, deployment, and recovery all contributed to the impact.
CrowdStrike IT Outage 10-Why Cause Map™
Following the outage, CrowdStrike investigated what went wrong and introduced changes to its software and work processes. Several of these changes address causes identified in our original analysis.
|
Changes to Software and Work Process |
Causes |
|
Expanded testing and validation to catch defects before release |
Defective configuration file approved for release |
|
Staged deployments and customer controls to limit how widely and quickly updates are distributed |
Defective configuration file deployed to machines |
|
Additional software safeguards, including bounds checking, to prevent the same type of system crash |
Computers couldn't enter Windows |
|
Automatic crash-loop recovery to reduce manual intervention |
On-site resources required to reboot computers in safe mode |
Each solution addresses a different area of the Cause Map™ diagram. Some reduce the likelihood of another defective update reaching customers. Others limit the potential impact or make recovery easier when problems occur.
The updated Cause Map diagram shows how these solutions address different causes of the outage.
CrowdStrike IT Outage 10-Why Cause Map™ with Solutions
Defects happen. Even the best testing processes won't catch everything. But one defective update shouldn't be able to bring down millions of computers worldwide.
CrowdStrike's response addresses several different causes to mitigate the risk of similar incidents occurring in the future. The lessons from this one incident pinpointed specific changes within different operational processes in the company. The company didn't just improve its testing. It also changed how updates are deployed, added safeguards against crashes, and improved recovery processes.
Even if the same situation occurs again, CrowdStrike’s solutions are designed to trap the problem at different points along the causal path before it produces a negative outcome. The same principle applies to driving: try to avoid driving off the road in the first place, but even if that happens, rumble strips, lane assist, guardrails and airbags help prevent the consequences from being more severe.
Each of CrowdStrike’s solutions provide another opportunity to stop a problem or reduce its impact. That's the value of looking beyond a single root cause: instead of relying on one solution to work perfectly, you can build multiple layers of protection in your operations.
Note: Information about the solutions described in this analysis comes from CrowdStrike's August 2024 Root Cause Analysis and July 2025 follow-up report. These sources detail changes to testing and validation, staged deployments that allow problems to be detected before wider rollout, additional safeguards against system crashes, and automatic recovery capabilities designed to reduce manual intervention. Readers can consult both reports for more information about these changes and how they were implemented.