An External Trigger Is Not a Continuity Defense

“It was the vendor’s faulty update, and our incident response did everything right, so the outage is not on us.”

No. Not in the board pack, and definitely not in front of a regulator.

An external trigger is not a continuity defense.

Incident response answers one question, and answers it well.

What is happening, how far has it spread, and how do we stop it?

Business continuity answers a different one.

How long did the business stay down, and who pays for that?

The first question has a culprit.

A vendor’s engineer.

A weather front.

The second question does not care.

You can contain cleanly.

You can scope accurately.

You can produce a timeline that would make an auditor quietly emotional.

Your organization can still answer for every hour its critical processes were not operating.

Two documented disputes say so in writing.

In December 2023 the US Department of Transportation found that winter weather was not the sole cause of Southwest Airlines’ December 2022 meltdown, and fined the airline $140 million.

In Delta Air Lines’ lawsuit over the July 2024 outage, CrowdStrike’s defense rests on a clause capping its exposure at the fees it was paid.

One regulator. One court.

Different bodies, same fight.

Nobody says, “the fire started in the building next door, so our evacuation plan is the neighbour’s problem.”

Yet move the fire into a vendor’s update channel and suddenly the continuity plan belongs to someone else.

It does not.

1. “But the Vendor Caused the Outage.”

Yes.

And?

Who started the outage and who answers for the recovery are two questions.

Southwest shows how far apart they sit.

Winter Storm Elliott happened.

Nobody disputed the storm.

The dispute was whether an airline can point to an external trigger to escape responsibility for a recovery process that could not absorb a foreseeable seasonal shock.

That process ran on a crew-rebooking system already known to be outdated.

During the event, crew members trying to reach scheduling specialists by phone faced holds of more than five hours.

The DOT’s December 2023 finding: the weather was not the sole cause.

The penalty: $140 million.

At the time, roughly 30 times the previous record DOT fine.

Plus a $90 million fund for future delay compensation.

On top of an estimated $1.1 to $1.2 billion in losses the airline had already reported from the meltdown.

The storm was the trigger. The regulator charged the recovery.

The same story also stops this being a sermon about old software.

In the July 2024 CrowdStrike-related outage, Southwest came through essentially unaffected.

Its crew-scheduling software was old enough, and different enough from the industry-standard tooling, not to share the failure point.

The same aging systems that shielded it in 2024 had contributed to its own meltdown in 2022.

So the lesson is not “keep old systems.”

It is that the trigger changes from year to year, and what gets charged is whether your recovery capacity matched the shock.

Now Delta, in that same July 2024 outage.

Same trigger as everyone else.

Delta took about five days to recover.

Competitors took roughly one.

Delta put its own cost at roughly $550 million: about $380 million in lost revenue and $170 million in extra expense.

The trigger was identical across the industry.

It cannot be what explains the difference.

2. “But Our Contract Makes the Vendor Liable.”

Read the contract.

Specifically, find the liability cap.

It is standard vendor drafting.

It fixes the vendor’s maximum exposure at the fees it was paid, however large your downstream loss turns out to be.

Which means the clause decided most of the dispute before the incident happened.

CrowdStrike’s defense against Delta rests on exactly that clause.

In October 2024 Delta sued for roughly $500 million, alleging gross negligence, breach of contract, computer trespass and deceptive business practices.

CrowdStrike countersued.

Its contract capped damages at fees paid, it argued, and it was not responsible for the length of Delta’s own recovery.

So the case did not turn on the size of Delta’s loss.

It turned on which legal theory could get past the cap.

An ordinary breach-of-contract claim runs straight into it.

In May 2025 a Georgia judge allowed the gross-negligence and computer-trespass claims to proceed and dismissed Delta’s broader fraud claims.

Gross negligence is the doorway.

It argues conduct egregious enough to void a damages limitation, and most jurisdictions will not let a contract disclaim that.

A court narrowed a wide accusation of blame down to the one door a liability cap does not close.

The May 2025 ruling was not a judgment.

It decided which claims could go forward, not how they would end.

And look at what is actually being fought over.

Was Delta’s five-day recovery a foreseeable consequence the cap was priced to cover?

Or a separate failure of Delta’s own continuity capability that the cap was never meant to insure?

That is the best case for a customer.

A large, documented loss, the resources to litigate, and a vendor whose update started the outage.

It still ends up arguing about its own recovery speed.

If the fees you paid your critical vendor are a rounding error beside a multi-day outage, the difference between the two is your continuity exposure.

Whether or not anyone wrote it down.

3. “But Insurance Will Absorb the Loss.”

Some of it.

Parametrix, an insurance analytics firm, estimated that the top 500 US companies affected by the July 2024 outage lost a combined $5.4 billion.

Insured: $540 million to $1.08 billion.

Roughly 10 to 20 percent.

Do the subtraction.

$5.4 billion minus $1.08 billion is $4.32 billion.

$5.4 billion minus $540 million is $4.86 billion.

Somewhere between $4.32 billion and $4.86 billion stayed with the companies.

On their balance sheets, or absorbed by whatever manual and redundant capacity they had funded before the event.

That is not a claims-handling problem.

It is a market that has not scaled coverage to the loss a shared-dependency event can produce.

Insurance and continuity are complements. Not substitutes.

Your policy limit was chosen in a calm renewal meeting.

Your outage estimate arrives in a bad week.

Nobody compared the two because nobody was asked to.

For scale, and only for scale, Splunk’s 2026 downtime research put the average unplanned-outage cost across Global 2000 companies at roughly $300 million a year per company.

That is an industry average across a year, not the cost of one incident and not your number.

But if your cyber policy’s headline limit looks generous, set it beside a realistic multi-day outage for your own critical processes.

Not beside last year’s premium.

4. “But the Crisis Team Has the Authority to Handle It.”

On paper.

The crisis management team is the cross-functional group a continuity plan designates to convene when a disruption is declared.

Operations, legal, communications, HR, IT, a senior executive in the chair.

It wants a pre-agreed activation trigger and delegated authority to spend without waiting for further sign-off.

What it frequently gets, once losses and public attention outgrow the plan, is someone stepping in above it.

Delta’s CEO, Ed Bastian, became the airline’s direct public voice during the July 2024 disruption.

On 23 July 2024, four days in, the US Department of Transportation opened a formal investigation into Delta’s handling of the event.

Neither of those was in the crisis team’s charter.

Southwest again: the DOT’s finding that the weather was not the sole cause was addressed to the company’s leadership.

Not to its business-continuity office.

ISO 22301 already puts this on top management.

Its leadership clause requires top management to demonstrate commitment to the continuity management system and establish the continuity policy directly, and to assign roles, responsibilities and authorities.

Most organizations read that as a signature.

In a public disruption it becomes a personal decision.

And capacity does not care who is sitting on the team.

A five-hour phone hold is a process that was never sized for the volume.

A better-chaired meeting does not answer the phone.

In a large enough disruption, authority is settled retroactively by whoever adjudicates blame.

Not by whoever the plan named.

5. “But the First Damage Estimate Is Manageable.”

It usually is.

That is the problem.

The first estimate is made before anyone knows the scope.

The City of Atlanta’s March 2018 SamSam ransomware response was first budgeted at $2.7 million in emergency contractor allocations.

As the scope of affected systems became clear over the following months, the city’s revised estimate for full restoration rose to $9.5 million.

$9.5 million divided by $2.7 million is about 3.5.

As of June 2018, three months after the attack, roughly a third of city software was still offline or partially disabled.

Ireland’s Health Service Executive shows the same shape at a different scale.

The Department of Health’s initial response allocation was €1 million.

The HSE spent €53 million on its own response.

The total restoration and network-upgrade estimate reached at least €100 million.

From the first figure to the last, a factor of at least 100.

Population data points the same way.

IBM’s Cost of a Data Breach research, as reported by Varonis, found that breaches whose lifecycle from compromise to full containment ran past 200 days averaged $5.01 million.

About $1.39 million more than breaches resolved inside 200 days.

An external trigger does not shorten scope discovery.

The first-week number is a floor, not a forecast.

If you tell the board in week one that the vendor did it and the cost is small, you have committed to two statements.

At least one of them is going to be revised.

6. “But Containment Had to Come First, and It Did.”

Good.

It should.

We have covered elsewhere why containment is not evidence preservation; here the point is narrower.

A correct containment sequence is a property of your response.

It is not an argument about your recovery time.

NIST SP 800-61 Rev. 2 frames containment strategy as a tradeoff across six factors.

Potential damage to and theft of resources.

The need to preserve evidence.

Service availability.

The time and resources the approach requires.

How effective it is expected to be.

How long the resulting solution needs to hold.

Look at the third one.

Service availability is on the list.

Containment is itself a decision about how long something stays down.

Isolating a compromised host that runs a production system preserves evidence and limits damage.

It also takes that production system away from the business.

So “we contained correctly” can include “we chose, deliberately, to keep a critical process offline.”

That may have been exactly right.

Whether the business could survive that interval was a continuity question.

It needed an answer before the incident, from someone who owns the process, not a defense afterwards from someone who owns the firewall.

One dating note.

NIST withdrew Rev. 2 on 3 April 2025 and replaced it with Rev. 3, which reframes incident response as a Community Profile aligned to the Cybersecurity Framework 2.0.

The reorganization does not reverse the tradeoff.

Availability still sits on the other side of the scale from evidence and damage.

7. No, This Does Not Mean the Vendor Is Off the Hook.

It isn’t.

Vendors can bear real responsibility.

A liability cap is not absolute; Delta’s gross-negligence and computer-trespass claims were allowed to proceed precisely because a cap does not easily close them.

Nothing here predicts that those claims will fail.

The May 2025 ruling decided what could be argued, not who would win.

Pursue the vendor where the facts support it.

The narrower point is the one that survives either outcome.

An external trigger does not settle who answers for the recovery.

So the continuity plan has to assume your organization will.

If the vendor eventually pays, treat it as recovered money.

Not as the plan.

8. What You Should Actually Do

Read your critical vendor contracts for liability caps. Find what the vendor’s exposure is fixed at, compare it with a realistic outage in your own processes, and treat the uncapped remainder as your own continuity exposure.

Put that number in the business-impact analysis, not in the legal file.

Compare insurance limits with a realistic multi-day outage estimate. Not with the policy headline, and not with the premium.

Assume the market pays a minority of a shared-dependency loss, because for July 2024 its share was estimated at roughly 10 to 20 percent.

Write down which executive takes over from the crisis team, and at what threshold. Public attention, a regulator’s inquiry, losses past a stated figure.

Then rehearse the handover, because in both airline cases the decisive authority ended up above the team the plan named.

Re-estimate incident cost on a fixed schedule. Set the interval before the incident, and revise as scope becomes known.

Report the first number as a floor, with the date it was made.

Record each containment decision against the six factors NIST lists. Including service availability.

When a containment choice keeps a critical process down, the process owner should know it at the time, not read it in the post-incident review.

Size recovery capacity to the shock, not to the trigger. A five-hour phone hold is a capacity number.

So is a five-day recovery against competitors’ one.

9. The Actual Model Is Not Complicated

Incident response asks: what happened, how far did it reach, and how do we stop it?

Business continuity asks: how long did the business stay down, and who answers for that?

The trigger answers the first question.

It does not answer the second.

A regulator has said so about a storm.

A vendor’s contract says so about an update, and a court has had to decide which door around it stays open.

Responsibility for recovery speed stays with the affected organization, whatever started the outage.

The fines, the rulings, the insurance estimates and the cost figures are dated evidence.

The allocation is not.

Your vendor can break your systems.

Only you can decide how long your business stays broken.