(Image credit: PIRO4D/Pixabay.)
As the industry rounded the corner from 2025 into the new year, one issue surfaced repeatedly in discussions with senior IT leaders across insurance: resiliency.
Over the past decade, many industry initiatives have focused on improving how core systems are built and managed. More modern platforms—and the architectures behind them—have been enabled in part by cloud computing. Even where moving workloads to the cloud did not always make sense, the appeal of “getting out of the data center business” was strong. Increasingly, capabilities are delivered “as a service,” shifting responsibility for environments and uptime to solution providers operating under pre-agreed service-level agreements. In theory, this all sounds compelling.
When Fewer Failures Hurt More
In practice, the recent past has exposed a different reality. In property/casualty claims, losses are evaluated through the twin lenses of frequency and severity. When carriers operated their own data centers, outages were more frequent, but the impact was usually limited. I lost data centers to a terrorist attack on 9/11, to a fire in Pennsylvania, and to a hurricane in North Carolina. Those events were dramatic—but rare—and recovery times were often surprisingly short.
Today, the frequency of incidents may be lower, but when something goes wrong, the severity can be extreme. Recent examples include the CrowdStrike incident, Scattered Spider attacks, and successive outages affecting AWS and Azure. These were among the most visible events, but they were not isolated. The start of 2026 also brought a significant outage at Verizon.
The Hidden Dependencies in Modern Ecosystems
In some cases, it may appear that an event had no direct impact on a carrier because the carrier was not a customer of the affected vendor. In reality, that distinction can be misleading. Even organizations running workloads on unaffected platforms may experience indirect disruption if a mission-critical vendor elsewhere in their ecosystem is compromised. As demonstrated by the back-to-back Amazon and Microsoft outages in late 2025, cascading effects are increasingly common.
One notable aspect of the Verizon outage was its breadth of impact, reflecting the central role cellular providers play in enabling utility services such as multi-factor authentication. In one representative scenario, a bank’s systems were technically operational but effectively inaccessible because MFA services were unavailable.
A life and annuities carrier client absorbed several of the 2025 events and then experienced a more traditional failure when a utility crew accidentally severed a fiber connection to its primary data center. At that point, the CEO asked a pointed question: What is wrong with our resiliency planning?
Resiliency Is a System Property
Years earlier, one of my software engineering directors had offered an insight that reshaped our thinking. Availability, he argued, is not determined by any single system or vendor, but by the combined performance of every participant in an organization’s accumulated ecosystem. Even if each vendor were operating at “five nines” availability—which they rarely were—the overall result would fall well short. That perspective changed how we approached vendor relationships, availability measurement, contract construction, and “unhappy path” planning within our own technology stack. Treating resiliency as a system-level property, rather than a collection of isolated assurances, materially improved outcomes.
As carriers move deeper into the back half of the decade, revisiting these fundamentals will be increasingly important. Ownership structures among solution providers may further complicate the picture, as mismatched time horizons can introduce new and often unanticipated risks.
The road ahead will only grow more complex. Addressing these dynamics now—explicitly and holistically—should help insurers better understand trade-offs and resource-allocation decisions needed to respond effectively when the next resiliency challenge emerges.
No dull moments ahead.