Abstract Technology Logo
Technology
Digital Sovereignty
Cloud & Infrastructure

When the Cloud Stops: What Vendor Dependence Really Costs You

The day the cloud stopped

On November 12, Microsoft 365 went down around the world. From Thursday evening, European time, Outlook and Exchange Online, Copilot and the Intune admin tools stopped responding. Downdetector logged reports from more than 70 countries. Government systems in Singapore and Japan were hit, along with the Supreme Court of the Philippines. More than twelve hours later, Microsoft was still reporting only “marginal success” in restoring service, with no root cause to share. Microsoft says it was not a cyberattack.

It wasn’t the first time. Three days earlier, on November 9, some Exchange Online users lost access to their mailboxes in Outlook on the web, first in Europe and then across EMEA, for about four and a half hours. And a year ago, on October 29, 2025, an “inadvertent tenant configuration change” in Azure Front Door took down Microsoft 365, Outlook, Teams, Xbox Live, Minecraft, the Azure portal itself, Alaska Airlines’ systems, Starbucks’ store tech, and parts of the banking and retail networks that live on Azure, all at once, for roughly nine hours. That came a week after AWS had done something similar.

If you don't read tech news, these aren't headlines. They are the mornings you lost. The presentation that wouldn't open. The email that wouldn't send. The shared drive that returned errors. The meeting that moved to WhatsApp because Teams was dark. The quiet realisation, around hour three, that nothing you were paid to do today was going to get done today.

This isn't rare anymore

Look at Microsoft's own 2026 incident history and the pattern is hard to miss: a nine-hour global Microsoft 365 outage in January. Service degradation across Copilot and Azure in May. A West US network failure in July. Teams, SharePoint and OneDrive down in late July. Gateway outages across eighteen regions at the end of September. An Exchange Online hit across EMEA on November 9. And on November 12, a global Microsoft 365 outage that was still unresolved more than twelve hours later. Every one of them traces back to the same architecture: one vendor, one global control plane, one bad day away from a quiet morning turning into a frantic one.

The point isn't that Microsoft is uniquely fragile. AWS failed the week before the Azure outage in October 2025. CloudFlare took out half the consumer internet in November 2025. Any sufficiently centralised stack behaves this way eventually - more automation, more surface area, more single points of failure that aren't single-vendor by accident but by design.

Nicky Stewart of the Open Cloud Coalition said it plainly after the October 2025 outage: these back-to-back incidents highlight the systemic risk of Europe's dependence on two American hyperscalers. That isn't an abstract political statement. That is a description of what people watched happen on their own screens.

What the outage actually shows you

When your presentation won't open, your mail won't send and your shared drive returns errors - all at the same time, with no estimate of recovery, and no local admin anywhere in the world who can do anything about it - you aren't looking at a technical glitch. You are looking at the real shape of a decision that was made years ago, usually on a spreadsheet that compared licence costs and nothing else.

Vendor dependence is the thing that is invisible on the good days and total on the bad ones. The good days look like efficiency: one contract, one login, one procurement conversation, one admin console, one neat line in the IT budget. The bad days look like the whole organisation sitting at desks with nothing to do, waiting for a status page in another country to go green.

The exposure isn't only operational. Your calendar, your mail, your documents, your chat history, your authentication, your identity itself - in a stack like that, all of it belongs to a counterparty you cannot negotiate with in the moment it matters. You find that out on the morning the counterparty is offline.

The quiet case we made for PHP

A few weeks ago we wrote on this blog about why we still build with PHP - a language that keeps getting written off and keeps running the web anyway. On the surface it was a technology post. Underneath it was the same argument we're making now.

PHP isn't the fastest, the newest, or the most fashionable choice. What it is: open, portable, hosted in a thousand different places, owned by nobody in particular, understood by a generation of developers, and still a safe bet thirty years in. The reason we still reach for it is the reason we reach for Open edX, for Linux, for open standards, for stacks we can move without permission: nobody can turn it off for us. Nobody raises the price next quarter because we're already in too deep to leave. Nobody rewrites the terms of service and sends an email.

Those aren't technical virtues. They are governance virtues wearing a technical costume. The PHP article was, quietly, about the same thing as this one. And luckily, none of our own services or client platforms were affected by any of these outages, including this week's.

Sovereignty isn't a slogan

at-blog-could-outage-sovereignity.webp

"Digital sovereignty" gets used a lot in European tech conversations, often as decoration. Stripped of the decoration, it means something concrete: can you still operate when your vendor cannot, will not, or is prevented from serving you? Can you host where you need to host? Can you move if you need to move? Can you read your own data without paying someone for permission? Does your public institution answer to its own citizens' laws, or to a foreign company's terms?

When those questions have good answers, an outage is a bad morning. When they have bad answers, an outage is a crisis- and the next contract renewal is a crisis you walked into willingly, with your eyes open, because the alternative seemed like more work.

For the organisations we work with - public institutions, universities, intergovernmental agencies, EU-funded projects - those questions aren't theoretical. They are written into procurement rules, auditor findings, and parliamentary questions. The outages of the past year are what happens when they get ignored.

What the people building Europe's answer are saying

Sovereignty is built, it cannot be bought.

- Thierry Breton, former European Commissioner for the Internal Market, at Connect 2025

We cannot afford to depend on others for the technologies that keep our hospitals running, our energy grids stable and our services secure.

- Ursula von der Leyen, President of the European Commission, announcing the EU Tech Sovereignty Package, June 2026

Today's major Microsoft Azure outage, coming just days after the widespread AWS disruption, highlights the systemic risk of Europe's dependence on the two American hyperscalers.

- Nicky Stewart, Senior Advisor to the Open Cloud Coalition, October 2025

This is not fringe opinion. According to a 2025 industry report, AWS, Azure and Google Cloud together hold about 70% of the European infrastructure cloud market; all European-headquartered providers combined account for roughly 15%. That ratio is what the outages keep exposing.

Value, not just price

Money matters. Our clients run real budgets and we take that seriously. But the honest calculation was never "licence A versus licence B at today's prices." It is:

  • What does the cheaper option cost me on the day it stops working?
  • What does it cost me in the year I decide to leave and discover I can't?
  • What does it cost me over the five years I let a single vendor shape not just my software but my processes, my training, my hiring, my data models, and what I can even imagine doing next?

A choice that saves 15% on paper and quietly removes your ability to steer the ship is not the cheaper choice. It is a deferred invoice, and you don't get to pick the day it falls due.

Value, in this business, is the option to keep working on the morning a status page in another country turns red.

The bet we've been making

Abstract Technology has spent years making a specific bet, and the past year has made it easier to explain.

We work with open source because open source doesn't go dark on a Thursday evening. We host in Europe because our customers' laws and ours are the same ones.

We build with openDesk - our sovereign office suite for files, email, chat and video calls - exactly for mornings like November 12.

We co-sell Open edX, Canvas, 360Learning and Payload because they interoperate, our clients can host them where they want, and when something breaks, somebody in the room can read the code. We invest in our own AI Studio and AI Assistant because the alternative is renting a roadmap someone else writes.

None of this is ideology. It's risk management with a long enough horizon to notice the risks that don't show up in the first quarter.

The clouds will keep going down. They will go down more, not less, as the stack gets more centralised and the configuration changes get more automated. The question for every organisation reading this is simple: on the morning it happens to you, which side of the story do you want to be on - the one waiting for a status page, or the one still working?

We know which side we have built for. We think it's still the better investment.

Sources and further reading

Open-source, EU-sovereign learning ecosystems - from collaboration to LMS/LXP.