[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fX77KkztobGd4cSWM0AxIoX7ffnlSH1PjFHkaMeV9rDE":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"a929e8d1-b191-4428-81b2-49dd9867b3a3","Microsoft 365 Crawls Back to Life After a 24-Hour Outage","microsoft-365-crawls-back-to-life-after-a-24-hour-outage-6b7a92","The company says a bad update—not a cyberattack or AI—caused its servers around the world to crash.","Microsoft 365 services experienced a widespread 24-hour outage affecting tens of millions of users across more than 70 countries, starting Thursday afternoon ET. The company attributed the incident to a technical issue during a network capacity upgrade and recent network change, explicitly ruling out cyberattacks or AI involvement. Microsoft increased email queue times to 48 hours to ensure message delivery and promised a full post-incident report once systems fully recovered.","Microsoft 365 outage affecting 70+ countries caused by bad network update, not cyberattack.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fmicrosoft-365-crawls-back-to-life-after-a-24-hour-outage\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6af75c7bac6958eb8481a5e6\u002Fmaster\u002Fpass\u002FSecurity_MicrosoftBackOnline_v1.jpg","2026-11-13T19:08:57+00:00","2026-11-13T20:00:16.463461+00:00",7,[17,20,23,25,27],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft 365","product",{"name":24,"type":22},"Outlook",{"name":26,"type":22},"Teams",{"name":28,"type":22},"Copilot","c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73",{"id":29,"icon":31,"name":32,"slug":33},null,"Incident Response","incident-response",[35,40],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[18,21,28],{"controls":48,"vendors":136},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-onum","Falcon Onum","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-siem\u002Ffalcon-onum\u002F","Real-time telemetry pipeline from CrowdStrike's purchase of Onum. It filters and streams data into Falcon Next-Gen SIEM and can run detections on third-party data before it is stored.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"edge-delta","Edge Delta","\u002Fvendor-logos\u002Fedge-delta.png","edge-delta-telemetry-pipelines","Telemetry Pipelines","https:\u002F\u002Fedgedelta.com\u002Fproduct\u002Ftelemetry-pipelines","Pipelines that process logs, metrics, traces and security events before they are indexed, with masking, hashing and pre-built packs, and a full-fidelity copy in object storage for rehydration.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-stream","Cribl Stream","https:\u002F\u002Fcribl.io\u002Fproducts\u002Fstream\u002F","Collects, reduces, redacts and routes data between sources and tools, keeps a full-fidelity copy in low-cost storage, and replays it when needed.",{"slug":79,"name":80,"problem":81,"products":82},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",{"slug":108,"name":109,"problem":110,"products":111},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",[137],{"slug":138,"name":18,"logo_path":139,"roles":140},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[141],"affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":152},"microsoft-365-outage-exposes-risks-of-unvalidated-network-changes","Microsoft 365 Outage Exposes Risks of Unvalidated Network Changes","A network capacity upgrade and recent configuration change caused a 24-hour global outage of Microsoft 365, impacting tens of millions of users across more than 70 countries. The root cause highlights how infrastructure changes — even those unrelated to security attacks — can cascade into major service disruptions when change management and rollback procedures are insufficient. Organizations relying on cloud-hosted productivity suites are reminded that upstream provider outages can paralyze their own operations without warning. This underscores the importance of business continuity planning that accounts for prolonged third-party service unavailability.",[147,148,149,150,151],"NIST SP 800-53 CM-3: Configuration Change Control","NIST SP 800-53 CP-2: Contingency Plan","NIST CSF 2.0 RS.CO-02: Incidents are reported to appropriate internal and external stakeholders","NIS2 Article 21(2)(b)","NIS2 Article 21(2)(c)",{"NIS2 Article 21(2)(b)":153,"NIS2 Article 21(2)(c)":154,"NIST SP 800-53 CP-2: Contingency Plan":155,"NIST SP 800-53 CM-3: Configuration Change Control":156,"NIST CSF 2.0 RS.CO-02: Incidents are reported to appropriate internal and external stakeholders":157},"NIS2's incident handling requirements obligate essential service providers to have structured processes for detecting, managing, and communicating significant incidents — gaps evident in the slow response and extended duration of this outage.","This point requires business continuity and crisis management planning, which both Microsoft and its dependent organizations needed in order to maintain operations and communications during a 24-hour service loss.","CP-2 requires organizations to develop and maintain contingency plans for continued operations during service disruptions, directly addressing the need for fallback procedures when a cloud provider like Microsoft 365 goes offline for 24 hours.","CM-3 requires formal review, testing, and approval of configuration changes before implementation — a process that, if applied to Microsoft's network capacity upgrade, could have caught the risky change before it caused a global outage.","Microsoft's delayed and partial communications during the outage highlight the importance of this category, which requires timely and transparent incident reporting to affected stakeholders."]