CrowdStrike outage spurs rethink on ‘critical’ vendors

CrowdStrike was not generally deemed a critical vendor by bank risk teams before last month’s outage—though some now think it perhaps should have been.

“While the assessment of criticality varies by company, CrowdStrike is often seen as a lower-tier vendor,” says a chief information security officer (Ciso) at a large global bank. “What happens with this type of security company is that we see them as utilities and never think of them going down. But in reality, they have the ability to basically