THE FRAGILITY PARADOX
More sophisticated. More dependent. More exposed.
The world does not have to stop working for your world to stop working.
On 13 November 2026, Microsoft’s global outage disrupted communications across organisations. NHS Supply Chain reported delayed patient-referral forms and interrupted order communications. The University of Auckland reported disruption across Microsoft applications and its travel-booking portal.
Different countries. Different purposes. Shared dependencies.
Yet NHS warehouses and transport continued operating, supported by alternative arrangements. That distinction matters - technological disruption does not have to become operational paralysis.
Rare’s own Global Cyber Disruption Index examines geopolitical pressure, exploited shared technology, critical infrastructure, hostile capability and recovery strain. Here, we extend that lens beyond cyber incidents to a wider question: are we creating capability faster than we are creating the ability to withstand its failure?
The cloud still lives on Earth
On 20 October 2026, a power disruption hit Google Cloud’s London zone europe-west2-b. A generator-control fault prevented emergency generators taking the load; batteries eventually depleted. Google reported that the primary impact was mitigated after six hours and eight minutes.
In March 2026, AWS reported drone strikes directly hitting two facilities in the UAE and damaging infrastructure near a Bahrain facility. Two of three UAE availability zones were significantly impaired.
The cloud had not escaped geography, electricity or conflict.
Nor is fragility exclusively digital. The IMO’s six-month assessment of the 2026 Hormuz crisis recorded at least 70 attacks on international shipping and 19 seafarer deaths. Digital supply-chain visibility cannot guarantee physically safe passage. A dashboard can show where the goods are; it cannot make the route viable.
Malicious activity is not necessary, either. The July 2024 CrowdStrike update affected an estimated 8.5 million Windows devices—less than 1% of Windows machines. Delta subsequently reported approximately 7,000 flight cancellations over five days and estimated a US$500 million financial impact.
A small share of devices can support an enormous share of consequential activity.
The architectural lesson is not “cloud bad”. It is that power, connectivity, identity, software, data and management systems are overlapping dependencies. Buying different applications does not establish independent failure paths.
Silver bullets conceal the system
ERP. Cloud. SaaS. Now AI. Rare’s term, Silver Bullet Syndrome, describes the decision error - buying (or being seduced into buying) an attractive answer before establishing the problem, its causes and the consequences of intervention.
A new system can accelerate a broken process. Integration can distribute bad data. Centralisation can make one administrative mistake everybody’s mistake. Automation can remove the pause in which somebody previously noticed something wrong.
These are failure scenarios, not arguments against technology.
Centralisation can improve consistency, security and access to expertise. The question is what we concentrate alongside those benefits—and what remains functional when that concentration fails. National Cyber Security Centre
A single platform should not become a single, unchallengeable authority. Citizens need human appeal routes. Businesses need exit options. Staff need permission and competence to act when the screen cannot.
“Everything is integrated” is not a resilience assessment.
AI multiplies capability—and consequences
The benefits are real. A study of 5,172 customer-support agents found AI assistance increased issues resolved per hour by 15% on average. That was a measured result in one organisation, not a universal productivity guarantee.
The infrastructure burden is also real. The International Energy Agency’s 2026 outlook projects data-centre electricity consumption rising from 485 terawatt-hours in 2025 to approximately 950 in 2030. AI-focused data-centre consumption is projected to triple over that period. Intelligence still needs power, chips, cooling, capital and functioning supply chains.
Then comes human reliance. A study surveying 319 knowledge workers found greater confidence in generative AI was associated with less reported critical thinking. It does not prove AI inevitably destroys judgement. It does challenge the assumption that greater usage automatically creates greater capability. Microsoft
Indeed, the ILO’s 2025 assessment estimated one in four workers globally was in an occupation with some generative-AI exposure, while stressing that transformation was more likely than wholesale replacement.
For employers, the strategic choice is not simply how many people AI might replace. It is which skills, accountability and independent judgement must survive.
Consider an AI purchasing agent connected to inventory, supplier accounts and payments. A mistaken recommendation can become an executed order. Give many organisations similar models, data and permissions, and correlated mistakes become a plausible systemic exposure—not an established forecast. The test is not whether AI can act. It is whether its authority is bounded, its evidence checked and its actions reversible.
Degrees of disruption ahead
For wider analysis, consider five qualitative degrees—not the index’s existing scoring bands or calibrated probabilities.
Contained disruption interrupts a tool. Organisational disruption stops business processes. Sector disruption disables a supplier used by many organisations. Cross-sector disruption spreads into health, transport, payments or government. Systemic disruption combines failures across essential infrastructure and overwhelms recovery capacity.
Our assessment is conditional - propensity for severe disruption rises when shared dependencies, privileged automation and concentrated infrastructure expand faster than fault isolation, recovery capacity and human competence. The cloud incidents illustrate how multiple safeguards can still share a consequential weakness.
Individual systems could become more reliable while rare common failures become more consequential. Sophistication alone therefore tells us little. What matters is the relationship between what a system enables and what its failure disables.
This is not a prediction of inevitable collapse. It is a reason to stop treating yesterday’s continuity arrangements as sufficient for tomorrow’s dependencies.
Build alternatives, not another silver bullet
The answer is selective centralisation with deliberate independence.
Federated arrangements can combine shared standards with local operating authority. Prioritise modular services, portable data, independent communications, protected recovery access and rehearsed fallback procedures.
But “multicloud” is not a magic word. The UK’s National Cyber Security Centre warns that using several clouds within one service can add complexity, increase attack exposure and even reduce availability. Resilience requires designed separation, not a larger collection of supplier logos.
Consider three practical tests.
A hospital should be able to access current, securely maintained essential care information and use a clinically approved downtime workflow when its main platform is unavailable.
A retailer should be able to capture orders, communicate with suppliers and reconcile transactions after recovery, using payment contingencies agreed with its provider.
A household should retain essential contacts, documents and recovery arrangements without depending entirely on one phone, account or connection.
These are proposed design requirements, not claims that every organisation already meets them. Canada’s Cyber Centre explicitly includes manual modes, alternative information flows and orderly degradation in contingency planning. Canadian Centre for Cyber Security
Governments should preserve accessible non-digital routes. Boards should demand evidence of recovery exercises. AI deployments should retain accountable human review and limits on consequential actions.
None of this means abandoning modern systems. It means refusing to abandon agency.
The real measure of progress
Before approving the next transformation, ask: what stops when this fails, who bears the consequences, and can we continue without it?
Efficiency is valuable. So are continuity, dignity and the capacity to recover.
The greatest exposure is not simply that sophisticated systems might fail.
It is that we may have engineered away our ability to function when they do.
Contact Rare Digital for a rapid Fragility & Recovery Assessment.
Whether in preparation for Global events or you've messy unmapped systems, expose hidden dependencies, test your ability to recover and prioritise practical safeguards. Know what could stop you. Know how to keep going.
Comments