The $600 Billion Wake Up Call

Patrick Lin
Splunk
Learn more about Cisco Splunk

In 2026, the cost of downtime or an outage is no longer just a technical inconvenience; it's a $600 billion wake up call for global businesses. As our digital ecosystems become more interconnected, each touchpoint introduces new risks and multiplies the consequences when things go wrong. And the data is clear: aggregate downtime costs  for Global 2,000 companies have surged 50% since 2024, reaching a staggering $600 billion.

According to Splunk's Hidden Costs of Downtime report, organizations face an average  of 60 service degradation incidents annually. And this official count reflects only the incidents organizations detected — the true number is likely larger. ITOps-related human error is the number one culprit of downtime, according to the report. As our IT estates become more complex and distributed, teams encounter more blind spots, increasing the likelihood of mistakes.

The negative impacts of an outage don't just stop with the hard costs. Downtime includes consequences that may be harder to track such as brand erosion, loss of customers and diminished shareholder value. Enterprises must also understand that hidden downtime costs don't just occur in the heat of an outage, but also well past the date(s) the incident occurred. Customer frustration continues, engineering teams can fall behind on the product roadmap, and marketing efforts meant for hyping up products  are now spent fixing a damaged reputation. It can take months of careful messaging and flawless service to rebuild the trust that was lost in mere moments.

The Causes of Downtime Vary

Mitigating the cost of downtime first calls for a fundamental understanding of how and  why system outages occur. While human error is still the leading culprit for many organizations, phishing scams and malware are often the gateway for the most dangerous types of system downtime — namely, ransomware attacks. Since 2004, ransomware payouts nearly tripled according to the survey findings, reaching $40M respectively.

After human error, software failure and third-party outages are the most common causes of application- or infrastructure-related downtime. Today's ITOps and engineering teams are relying on external providers that have become a primary source  of instability. That's why visibility into unowned networks and external dependencies — along with the applications themselves, of course — is a prerequisite for digital resilience.

Harnessing AI and the Practice of Observability to Lower the Cost of Downtime

The reality is system outages or disruptions are inevitable — and the most resilient organizations implement tools and practices that enable them to respond effectively under pressure. A comprehensive observability practice is a key supporting business function to a resilient organization. More than ever, today's organizations must be able to see, understand, and diagnose every issue within their tech stack, regardless of the type of environment, and as early as possible. This means visibility into any application or infrastructure, whether on-premises or cloud-delivered, along with the implications of their health and performance on business KPIs and user experience. 72% of ITOps and  engineering leaders rank end-to-end observability as their top investment priority, ahead  of spending on the infrastructure itself, even.

More importantly, AI is arming today's threat actors with the ability to raise the cost of system downtime, so today's cyber defenders must also leverage AI. A powerful ally in  the fight against downtime, AI can be used by teams to accelerate insight and incident  detection of issues. Observability, powered by agentic AI, can independently diagnose  issues, execute common fixes, perform code rollbacks, and escalate more important functions for human approval. It should be noted that these human-in-the-loop measures aren't just for safety; it is a governance framework for any AI use within an observability practice. This governance model ensures speed never comes at the expense of trust and accountability.

Bouncing Back: A Blueprint for Resilience

Beyond observability, the most resilient organizations bounce back faster by following these four best practices:

1. Treat downtime as a business risk. With key decision-makers, translate technical metrics into business language — connect incidents to profit impact, recovery timelines, and customer trust. This will help get executive attention and  support.

2. Design systems for humans. Complex systems can result in more human error. Standardize deployment practices to ensure consistency, accountability,  and controlled execution across teams.

3. Make detection and root cause analysis a team sport. Reduce silos by leveraging platforms, tools and workspaces that provide shared data across the  SecOps and DevOps teams to encourage collaboration and holistic visibility.

4. Use AI to accelerate insight. When deploying AI to speed up incident detection,  root cause analysis, or prioritization, always pair AI's speed with expert human  judgment and oversight.

These tenets, combined with implementing an observability practice as a core business  function, can both put a major dent in the cost of downtime while making operational resilience a reality. 

Patrick Lin is SVP and GM, Observability at Splunk, a Cisco company

Related Links

Hot Topics

Related Vendors

The Latest

When the Database Is the Problem, Is APM Enough?

Production incidents rarely announce themselves as database problems. They appear as slow transactions, timeouts, rising response times, or an application struggling under a workload it previously handled. APM provides an essential starting point. It can identify a slow transaction path, highlight an affected service, and show that a database dependency is consuming more time than expected. But identifying the database as part of the problem is not the same as explaining what is happening inside it ...

From Cleanup to Prevention: The Future of Cloud-Native Cost Optimization

Cloud teams are under constant pressure to reduce spend without slowing development or increasing operational risk. They are deploying autoscalers, rightsizing workloads, enforcing resource requests, reviewing utilization dashboards, and building FinOps processes around cloud-native environments. Yet the results often disappoint ...

The Real Enterprise AI Risk Isn't Hallucinations

Ask most IT leaders about their biggest concern with AI and you'll hear the same answer: hallucinations ... Today, however, the conversation has shifted ... As organizations move beyond chatbots and experiments, they are increasingly deploying AI agents that perform multi-step tasks. These systems retrieve documents, query databases, call APIs, generate reports, write code, and make recommendations. The issue is not whether the model can reason. The issue is whether the organization can see, verify, and govern the decisions being made along the way ...

Beyond Buy vs. Build: The New Playbook for Data Pipelines

While organizations want to take control of their telemetry, building telemetry pipelines from scratch can be a very daunting, complicated task, even when leveraging open-source standards like OpenTelemetry. It requires specialized knowledge across distributed systems, data engineering, and security. This fragmented approach across systems causes higher operational costs; it puts a strain on resources and reduces efficiency as teams have to work with different interfaces and processes ...

The Corporate Network Is Fading - Here's What Replaces It

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

IT Leaders Must Establish a Network Data Architecture Practice

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

Data Center Outages Are Decreasing but More Costly

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

Observability Has a Physical Layer Now: What AI Infrastructure Teaches IT Operations

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

TLS Certificate Expiration Is Becoming an Observability Problem

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...

Enterprise Cloud Observability: Choosing the Right Starting Point

Enterprises operate different combinations of workloads across cloud, hybrid and multicloud environments. For business-critical workloads, teams need to consider monitoring and observability early so they can detect health issues, investigate failures, and understand operational impact. Organizations place workloads on cloud platforms based on a combination of technical requirements, economics, existing dependencies, organizational standards, and business priorities. Their monitoring priorities therefore depend on what they operate and where those systems run. Those priorities will not look the same for every organization ...

The $600 Billion Wake Up Call

Patrick Lin
Splunk
Learn more about Cisco Splunk

In 2026, the cost of downtime or an outage is no longer just a technical inconvenience; it's a $600 billion wake up call for global businesses. As our digital ecosystems become more interconnected, each touchpoint introduces new risks and multiplies the consequences when things go wrong. And the data is clear: aggregate downtime costs  for Global 2,000 companies have surged 50% since 2024, reaching a staggering $600 billion.

According to Splunk's Hidden Costs of Downtime report, organizations face an average  of 60 service degradation incidents annually. And this official count reflects only the incidents organizations detected — the true number is likely larger. ITOps-related human error is the number one culprit of downtime, according to the report. As our IT estates become more complex and distributed, teams encounter more blind spots, increasing the likelihood of mistakes.

The negative impacts of an outage don't just stop with the hard costs. Downtime includes consequences that may be harder to track such as brand erosion, loss of customers and diminished shareholder value. Enterprises must also understand that hidden downtime costs don't just occur in the heat of an outage, but also well past the date(s) the incident occurred. Customer frustration continues, engineering teams can fall behind on the product roadmap, and marketing efforts meant for hyping up products  are now spent fixing a damaged reputation. It can take months of careful messaging and flawless service to rebuild the trust that was lost in mere moments.

The Causes of Downtime Vary

Mitigating the cost of downtime first calls for a fundamental understanding of how and  why system outages occur. While human error is still the leading culprit for many organizations, phishing scams and malware are often the gateway for the most dangerous types of system downtime — namely, ransomware attacks. Since 2004, ransomware payouts nearly tripled according to the survey findings, reaching $40M respectively.

After human error, software failure and third-party outages are the most common causes of application- or infrastructure-related downtime. Today's ITOps and engineering teams are relying on external providers that have become a primary source  of instability. That's why visibility into unowned networks and external dependencies — along with the applications themselves, of course — is a prerequisite for digital resilience.

Harnessing AI and the Practice of Observability to Lower the Cost of Downtime

The reality is system outages or disruptions are inevitable — and the most resilient organizations implement tools and practices that enable them to respond effectively under pressure. A comprehensive observability practice is a key supporting business function to a resilient organization. More than ever, today's organizations must be able to see, understand, and diagnose every issue within their tech stack, regardless of the type of environment, and as early as possible. This means visibility into any application or infrastructure, whether on-premises or cloud-delivered, along with the implications of their health and performance on business KPIs and user experience. 72% of ITOps and  engineering leaders rank end-to-end observability as their top investment priority, ahead  of spending on the infrastructure itself, even.

More importantly, AI is arming today's threat actors with the ability to raise the cost of system downtime, so today's cyber defenders must also leverage AI. A powerful ally in  the fight against downtime, AI can be used by teams to accelerate insight and incident  detection of issues. Observability, powered by agentic AI, can independently diagnose  issues, execute common fixes, perform code rollbacks, and escalate more important functions for human approval. It should be noted that these human-in-the-loop measures aren't just for safety; it is a governance framework for any AI use within an observability practice. This governance model ensures speed never comes at the expense of trust and accountability.

Bouncing Back: A Blueprint for Resilience

Beyond observability, the most resilient organizations bounce back faster by following these four best practices:

1. Treat downtime as a business risk. With key decision-makers, translate technical metrics into business language — connect incidents to profit impact, recovery timelines, and customer trust. This will help get executive attention and  support.

2. Design systems for humans. Complex systems can result in more human error. Standardize deployment practices to ensure consistency, accountability,  and controlled execution across teams.

3. Make detection and root cause analysis a team sport. Reduce silos by leveraging platforms, tools and workspaces that provide shared data across the  SecOps and DevOps teams to encourage collaboration and holistic visibility.

4. Use AI to accelerate insight. When deploying AI to speed up incident detection,  root cause analysis, or prioritization, always pair AI's speed with expert human  judgment and oversight.

These tenets, combined with implementing an observability practice as a core business  function, can both put a major dent in the cost of downtime while making operational resilience a reality. 

Patrick Lin is SVP and GM, Observability at Splunk, a Cisco company

Related Links

Hot Topics

Related Vendors

The Latest

When the Database Is the Problem, Is APM Enough?

Production incidents rarely announce themselves as database problems. They appear as slow transactions, timeouts, rising response times, or an application struggling under a workload it previously handled. APM provides an essential starting point. It can identify a slow transaction path, highlight an affected service, and show that a database dependency is consuming more time than expected. But identifying the database as part of the problem is not the same as explaining what is happening inside it ...

From Cleanup to Prevention: The Future of Cloud-Native Cost Optimization

Cloud teams are under constant pressure to reduce spend without slowing development or increasing operational risk. They are deploying autoscalers, rightsizing workloads, enforcing resource requests, reviewing utilization dashboards, and building FinOps processes around cloud-native environments. Yet the results often disappoint ...

The Real Enterprise AI Risk Isn't Hallucinations

Ask most IT leaders about their biggest concern with AI and you'll hear the same answer: hallucinations ... Today, however, the conversation has shifted ... As organizations move beyond chatbots and experiments, they are increasingly deploying AI agents that perform multi-step tasks. These systems retrieve documents, query databases, call APIs, generate reports, write code, and make recommendations. The issue is not whether the model can reason. The issue is whether the organization can see, verify, and govern the decisions being made along the way ...

Beyond Buy vs. Build: The New Playbook for Data Pipelines

While organizations want to take control of their telemetry, building telemetry pipelines from scratch can be a very daunting, complicated task, even when leveraging open-source standards like OpenTelemetry. It requires specialized knowledge across distributed systems, data engineering, and security. This fragmented approach across systems causes higher operational costs; it puts a strain on resources and reduces efficiency as teams have to work with different interfaces and processes ...

The Corporate Network Is Fading - Here's What Replaces It

For decades, enterprise networks were designed around a simple assumption: work happened inside the office. Applications lived in centralized data centers, employees connected through internal infrastructure, and security focused on protecting the perimeter that surrounded everything ... But the way organizations operate today bears little resemblance to that environment. Cloud platforms host critical applications, employees connect from homes and airports as often as they do from offices, and partners collaborate through shared systems that exist far beyond corporate walls. In short, the corporate network no longer resembles the environment it was designed to protect ...

IT Leaders Must Establish a Network Data Architecture Practice

As an analyst who researches how IT organizations design, build, and operate their networks, I find that network data is a constant source of pain. Network teams struggle with data quality, fragmentation, authority, access, and trust. And these issues undermine everything they try to do. Here are the numbers: Only 45% of network teams are completely confident in the accuracy of their network source of truth, which documents the intent of their network ...

Data Center Outages Are Decreasing but More Costly

The 2026 Global Data Center Survey from Uptime Institute reveals an industry navigating workforce constraints, escalating outage expenses, even as rising costs remain the top concern for management teams ...

Observability Has a Physical Layer Now: What AI Infrastructure Teaches IT Operations

The next observability gap may not be in the code. It may be under the rack. That sounds strange until you think about how AI incidents actually feel in the middle of an investigation ... The application dashboard may be accurate. It may also be stopping at the wrong boundary. AI systems depend on software, but they also depend on a dense physical stack: racks, power paths, thermal margin, maintenance activity and, in many environments, liquid cooling. Those physical dependencies can change slowly before they look like a software incident ...

TLS Certificate Expiration Is Becoming an Observability Problem

Certificate expiration is the rare outage you can see coming. Every TLS certificate carries the date it stops working, so the moment it will begin breaking connections is knowable in advance. That's what makes an expired certificate such a frustrating way to lose a service. What's changing now is how often that date comes around ...

Enterprise Cloud Observability: Choosing the Right Starting Point

Enterprises operate different combinations of workloads across cloud, hybrid and multicloud environments. For business-critical workloads, teams need to consider monitoring and observability early so they can detect health issues, investigate failures, and understand operational impact. Organizations place workloads on cloud platforms based on a combination of technical requirements, economics, existing dependencies, organizational standards, and business priorities. Their monitoring priorities therefore depend on what they operate and where those systems run. Those priorities will not look the same for every organization ...