The $600 Billion Wake Up Call

Patrick Lin
Splunk
Learn more about Cisco Splunk

In 2026, the cost of downtime or an outage is no longer just a technical inconvenience; it's a $600 billion wake up call for global businesses. As our digital ecosystems become  more interconnected, each touchpoint introduces new risks and multiplies the consequences when things go wrong. And the data is clear: aggregate downtime costs  for Global 2,000 companies have surged 50% since 2024, reaching a staggering $600 billion.

According to Splunk's Hidden Costs of Downtime report, organizations face an average  of 60 service degradation incidents annually. And this official count reflects only the incidents organizations detected — the true number is likely larger. ITOps-related human error is the number one culprit of downtime, according to the report. As our IT estates become more complex and distributed, teams encounter more blind spots, increasing the likelihood of mistakes.

The negative impacts of an outage don't just stop with the hard costs. Downtime includes consequences that may be harder to track such as brand erosion, loss of customers and diminished shareholder value. Enterprises must also understand that hidden downtime costs don't just occur in the heat of an outage, but also well past the date(s) the incident occurred. Customer frustration continues, engineering teams can fall behind on the product roadmap, and marketing efforts meant for hyping up products  are now spent fixing a damaged reputation. It can take months of careful messaging and flawless service to rebuild the trust that was lost in mere moments.

The Causes of Downtime Vary

Mitigating the cost of downtime first calls for a fundamental understanding of how and  why system outages occur. While human error is still the leading culprit for many organizations, phishing scams and malware are often the gateway for the most dangerous types of system downtime — namely, ransomware attacks. Since 2004, ransomware payouts nearly tripled according to the survey findings, reaching $40M respectively.

After human error, software failure and third-party outages are the most common causes of application- or infrastructure-related downtime. Today's ITOps and engineering teams are relying on external providers that have become a primary source  of instability. That's why visibility into unowned networks and external dependencies — along with the applications themselves, of course — is a prerequisite for digital resilience.

Harnessing AI and the Practice of Observability to Lower the Cost of Downtime

The reality is system outages or disruptions are inevitable — and the most resilient organizations implement tools and practices that enable them to respond effectively under pressure. A comprehensive observability practice is a key supporting business function to a resilient organization. More than ever, today's organizations must be able to see, understand, and diagnose every issue within their tech stack, regardless of the type of environment, and as early as possible. This means visibility into any application or infrastructure, whether on-premises or cloud-delivered, along with the implications of their health and performance on business KPIs and user experience. 72% of ITOps and  engineering leaders rank end-to-end observability as their top investment priority, ahead  of spending on the infrastructure itself, even.

More importantly, AI is arming today's threat actors with the ability to raise the cost of system downtime, so today's cyber defenders must also leverage AI. A powerful ally in  the fight against downtime, AI can be used by teams to accelerate insight and incident  detection of issues. Observability, powered by agentic AI, can independently diagnose  issues, execute common fixes, perform code rollbacks, and escalate more important functions for human approval. It should be noted that these human-in-the-loop measures aren't just for safety; it is a governance framework for any AI use within an observability practice. This governance model ensures speed never comes at the expense of trust and accountability.

Bouncing Back: A Blueprint for Resilience

Beyond observability, the most resilient organizations bounce back faster by following these four best practices:

1. Treat downtime as a business risk. With key decision-makers, translate technical metrics into business language — connect incidents to profit impact, recovery timelines, and customer trust. This will help get executive attention and  support.

2. Design systems for humans. Complex systems can result in more human error. Standardize deployment practices to ensure consistency, accountability,  and controlled execution across teams.

3. Make detection and root cause analysis a team sport. Reduce silos by leveraging platforms, tools and workspaces that provide shared data across the  SecOps and DevOps teams to encourage collaboration and holistic visibility.

4. Use AI to accelerate insight. When deploying AI to speed up incident detection,  root cause analysis, or prioritization, always pair AI's speed with expert human  judgment and oversight.

These tenets, combined with implementing an observability practice as a core business  function, can both put a major dent in the cost of downtime while making operational resilience a reality. 

Patrick Lin is SVP and GM, Observability at Splunk, a Cisco company

Related Links

Hot Topics

Related Vendors

The Latest

Observability Is Becoming the Grid That Powers AI - and It Isn't Ready

For fifteen years, observability lived downstream of everything else. Code shipped, something broke, an engineer went to the dashboards. The job was forensic. The pillars we built, such as logs, metrics, and traces, were designed for that role: tell a human what just happened, fast enough that they can make it stop. That role has quietly ended ...

Hybrid IT Dominates Enterprise Architecture, with Colocation Anchoring Critical Workloads

Hybrid IT has become the standard operating model for enterprises — but that companies are still looking for the right hybrid IT mix, according to the 2026 State of the Data Center Report from CoreSite. After years of cloud migration and hybrid adoption, organizations are shifting their focus from deciding whether to use cloud, colocation or on-premises infrastructure to determining which workloads belong in each environment ...

AI is Moving Fast, and Enterprise File Data Is Not Ready

Pilots are everywhere, stakeholders are seeking results, businesses are pushing for new tools, and IT teams are being asked to make AI secure, reliable, and useful at scale. But as organizations move from testing AI to operationalizing it, many are discovering that the biggest barrier is not the model, the use case, or even the budget. It is the file data foundation within ...

Move Fast Without the Usual Quality Penalty

Fast or cheap? For most of my career in engineering, speed and quality sat on opposite ends of a seesaw. The "OR" in "fast or cheap" was non-negotiable. It was expected that pushing for faster releases meant that something in quality would give way. Tightening quality controls meant the schedule slipped. Every engineering leader I know has lived some version of that tradeoff ... The seesaw is starting to level out ...

When the Observability Bill Arrives for Agentic AI

I have been building enterprise software for more than 20 years ... One thing stays true across all of it: You do not find out your foundation is wrong during the crisis. You find out when the debt comes due. For a lot of organizations, that bill is arriving now. New research ... puts hard numbers on something practitioners have been sensing for a while. The telemetry problem isn't coming. It's already here ...

AI is Breaking Enterprise Log Management

The rapid growth of AI workloads is pushing traditional log management approaches to their limits, according to The State of Log Management 2026 report from Dynatrace. Modern logs have become critical to understanding, validating, and securing AI-driven decisions, helping organizations ensure reliability, compliance, and performance at scale. However, the volume and complexity of AI telemetry are overwhelming legacy tools ...

How Edge Intelligence Will Redefine Secure Connectivity

For years, secure connectivity has relied on a familiar pattern: route traffic back to centralized gateways, inspect it, and then allow access. This model worked when applications lived in a handful of data centers and users were largely confined to offices. That model is now under strain. Applications are distributed across clouds, users connect from everywhere, and real-time workloads demand performance that centralized inspection points struggle to deliver. As traffic volumes grow and latency expectations shrink, routing everything through a small number of control points has become both a performance bottleneck and a resilience risk. The future of secure connectivity requires a different approach ...

Production Inference Shifts Decisively to Private Cloud

The AI experimentation phase is over, and the private cloud is where enterprise AI workloads are being deployed for security and scale, according to Private Cloud Outlook 2026, a new report from Broadcom ... 2026 marks an acceleration into a full AI tipping point. The shift is being shaped by three forces — costs, complexity, and control — that public cloud environments are increasingly failing to address for production AI at scale. Key findings from the report include ...

Why DevOps Teams Build GenAI Tooling While Most Organizations Still Rely on Manual Monitoring

44% of organizations have reported an outage in the past year tied to suppressed or ignored alerts, and 78% had at least one incident where no alert was fired at all ... Engineers learned about failures from customers. That gap between what our tools report and what our customers experience is the problem DevOps teams have been quietly solving with GenAI tooling, even as most enterprises continue to run their NOCs on manual alert triage ...

Why Cloud Reliability Comes Down to People and How to Improve It

Cloud outages are usually described as technical failures. When a service goes down, a dependency breaks, or a region has issues, the focus immediately shifts to infrastructure. But if you look closely at how these incidents actually unfold, the root cause is rarely the technology itself. It is almost always tied to decisions made earlier, during design, implementation, or day-to-day operations. The system behaves the way it was built. The real question is how it was built ...

The $600 Billion Wake Up Call

Patrick Lin
Splunk
Learn more about Cisco Splunk

In 2026, the cost of downtime or an outage is no longer just a technical inconvenience; it's a $600 billion wake up call for global businesses. As our digital ecosystems become  more interconnected, each touchpoint introduces new risks and multiplies the consequences when things go wrong. And the data is clear: aggregate downtime costs  for Global 2,000 companies have surged 50% since 2024, reaching a staggering $600 billion.

According to Splunk's Hidden Costs of Downtime report, organizations face an average  of 60 service degradation incidents annually. And this official count reflects only the incidents organizations detected — the true number is likely larger. ITOps-related human error is the number one culprit of downtime, according to the report. As our IT estates become more complex and distributed, teams encounter more blind spots, increasing the likelihood of mistakes.

The negative impacts of an outage don't just stop with the hard costs. Downtime includes consequences that may be harder to track such as brand erosion, loss of customers and diminished shareholder value. Enterprises must also understand that hidden downtime costs don't just occur in the heat of an outage, but also well past the date(s) the incident occurred. Customer frustration continues, engineering teams can fall behind on the product roadmap, and marketing efforts meant for hyping up products  are now spent fixing a damaged reputation. It can take months of careful messaging and flawless service to rebuild the trust that was lost in mere moments.

The Causes of Downtime Vary

Mitigating the cost of downtime first calls for a fundamental understanding of how and  why system outages occur. While human error is still the leading culprit for many organizations, phishing scams and malware are often the gateway for the most dangerous types of system downtime — namely, ransomware attacks. Since 2004, ransomware payouts nearly tripled according to the survey findings, reaching $40M respectively.

After human error, software failure and third-party outages are the most common causes of application- or infrastructure-related downtime. Today's ITOps and engineering teams are relying on external providers that have become a primary source  of instability. That's why visibility into unowned networks and external dependencies — along with the applications themselves, of course — is a prerequisite for digital resilience.

Harnessing AI and the Practice of Observability to Lower the Cost of Downtime

The reality is system outages or disruptions are inevitable — and the most resilient organizations implement tools and practices that enable them to respond effectively under pressure. A comprehensive observability practice is a key supporting business function to a resilient organization. More than ever, today's organizations must be able to see, understand, and diagnose every issue within their tech stack, regardless of the type of environment, and as early as possible. This means visibility into any application or infrastructure, whether on-premises or cloud-delivered, along with the implications of their health and performance on business KPIs and user experience. 72% of ITOps and  engineering leaders rank end-to-end observability as their top investment priority, ahead  of spending on the infrastructure itself, even.

More importantly, AI is arming today's threat actors with the ability to raise the cost of system downtime, so today's cyber defenders must also leverage AI. A powerful ally in  the fight against downtime, AI can be used by teams to accelerate insight and incident  detection of issues. Observability, powered by agentic AI, can independently diagnose  issues, execute common fixes, perform code rollbacks, and escalate more important functions for human approval. It should be noted that these human-in-the-loop measures aren't just for safety; it is a governance framework for any AI use within an observability practice. This governance model ensures speed never comes at the expense of trust and accountability.

Bouncing Back: A Blueprint for Resilience

Beyond observability, the most resilient organizations bounce back faster by following these four best practices:

1. Treat downtime as a business risk. With key decision-makers, translate technical metrics into business language — connect incidents to profit impact, recovery timelines, and customer trust. This will help get executive attention and  support.

2. Design systems for humans. Complex systems can result in more human error. Standardize deployment practices to ensure consistency, accountability,  and controlled execution across teams.

3. Make detection and root cause analysis a team sport. Reduce silos by leveraging platforms, tools and workspaces that provide shared data across the  SecOps and DevOps teams to encourage collaboration and holistic visibility.

4. Use AI to accelerate insight. When deploying AI to speed up incident detection,  root cause analysis, or prioritization, always pair AI's speed with expert human  judgment and oversight.

These tenets, combined with implementing an observability practice as a core business  function, can both put a major dent in the cost of downtime while making operational resilience a reality. 

Patrick Lin is SVP and GM, Observability at Splunk, a Cisco company

Related Links

Hot Topics

Related Vendors

The Latest

Observability Is Becoming the Grid That Powers AI - and It Isn't Ready

For fifteen years, observability lived downstream of everything else. Code shipped, something broke, an engineer went to the dashboards. The job was forensic. The pillars we built, such as logs, metrics, and traces, were designed for that role: tell a human what just happened, fast enough that they can make it stop. That role has quietly ended ...

Hybrid IT Dominates Enterprise Architecture, with Colocation Anchoring Critical Workloads

Hybrid IT has become the standard operating model for enterprises — but that companies are still looking for the right hybrid IT mix, according to the 2026 State of the Data Center Report from CoreSite. After years of cloud migration and hybrid adoption, organizations are shifting their focus from deciding whether to use cloud, colocation or on-premises infrastructure to determining which workloads belong in each environment ...

AI is Moving Fast, and Enterprise File Data Is Not Ready

Pilots are everywhere, stakeholders are seeking results, businesses are pushing for new tools, and IT teams are being asked to make AI secure, reliable, and useful at scale. But as organizations move from testing AI to operationalizing it, many are discovering that the biggest barrier is not the model, the use case, or even the budget. It is the file data foundation within ...

Move Fast Without the Usual Quality Penalty

Fast or cheap? For most of my career in engineering, speed and quality sat on opposite ends of a seesaw. The "OR" in "fast or cheap" was non-negotiable. It was expected that pushing for faster releases meant that something in quality would give way. Tightening quality controls meant the schedule slipped. Every engineering leader I know has lived some version of that tradeoff ... The seesaw is starting to level out ...

When the Observability Bill Arrives for Agentic AI

I have been building enterprise software for more than 20 years ... One thing stays true across all of it: You do not find out your foundation is wrong during the crisis. You find out when the debt comes due. For a lot of organizations, that bill is arriving now. New research ... puts hard numbers on something practitioners have been sensing for a while. The telemetry problem isn't coming. It's already here ...

AI is Breaking Enterprise Log Management

The rapid growth of AI workloads is pushing traditional log management approaches to their limits, according to The State of Log Management 2026 report from Dynatrace. Modern logs have become critical to understanding, validating, and securing AI-driven decisions, helping organizations ensure reliability, compliance, and performance at scale. However, the volume and complexity of AI telemetry are overwhelming legacy tools ...

How Edge Intelligence Will Redefine Secure Connectivity

For years, secure connectivity has relied on a familiar pattern: route traffic back to centralized gateways, inspect it, and then allow access. This model worked when applications lived in a handful of data centers and users were largely confined to offices. That model is now under strain. Applications are distributed across clouds, users connect from everywhere, and real-time workloads demand performance that centralized inspection points struggle to deliver. As traffic volumes grow and latency expectations shrink, routing everything through a small number of control points has become both a performance bottleneck and a resilience risk. The future of secure connectivity requires a different approach ...

Production Inference Shifts Decisively to Private Cloud

The AI experimentation phase is over, and the private cloud is where enterprise AI workloads are being deployed for security and scale, according to Private Cloud Outlook 2026, a new report from Broadcom ... 2026 marks an acceleration into a full AI tipping point. The shift is being shaped by three forces — costs, complexity, and control — that public cloud environments are increasingly failing to address for production AI at scale. Key findings from the report include ...

Why DevOps Teams Build GenAI Tooling While Most Organizations Still Rely on Manual Monitoring

44% of organizations have reported an outage in the past year tied to suppressed or ignored alerts, and 78% had at least one incident where no alert was fired at all ... Engineers learned about failures from customers. That gap between what our tools report and what our customers experience is the problem DevOps teams have been quietly solving with GenAI tooling, even as most enterprises continue to run their NOCs on manual alert triage ...

Why Cloud Reliability Comes Down to People and How to Improve It

Cloud outages are usually described as technical failures. When a service goes down, a dependency breaks, or a region has issues, the focus immediately shifts to infrastructure. But if you look closely at how these incidents actually unfold, the root cause is rarely the technology itself. It is almost always tied to decisions made earlier, during design, implementation, or day-to-day operations. The system behaves the way it was built. The real question is how it was built ...