A major Salesforce outage lasting about seven and a half hours on September 16 has highlighted the hidden resilience risks created by dependence on cloud-based platforms. The disruption affected multiple Salesforce instances across regions, causing severe delays, intermittent errors and problems accessing services while the company investigated the underlying failure.
Salesforce initially attributed the incident to an external dependency failure affecting its legacy login server. A core component experienced increased load, reducing its capacity to process requests. The company subsequently worked through rolling restarts, regional fixes and further technical remediation before services were restored and the incident was declared resolved at around 2:59 p.m. EDT.
The incident illustrates an important misconception about cloud computing: moving systems to the cloud does not eliminate technology dependencies or operational risk.
According to analysis cited by CIO, cloud architectures can sometimes make dependencies less visible. When a cloud platform becomes an organisation’s system of record, a failure in one supporting component can therefore become an enterprise-wide business risk rather than simply an IT problem.
The Hidden Data Problem
The consequences of an outage can continue even after users regain access.
When a system such as Salesforce is unavailable, transactions, customer-service interactions and automated processes may be delayed or fail completely. APIs and middleware can accumulate retries and queues, while scheduled jobs and workflows may not execute as expected. This can temporarily create inconsistencies between systems.
The risk is therefore not simply “Can employees log in again?”. Organisations also need to establish whether transactions were completed, duplicated, delayed or lost and whether downstream systems have returned to a consistent state.
Security teams also need to review authentication activity, privileged access, integration credentials and emergency changes made during incident recovery.
Dependency Mapping Becomes Critical
One of the strongest lessons from the incident is the importance of understanding the dependency graph behind critical technology services.
A component does not have to be large or visibly important to become a critical point of failure. A legacy authentication service, for example, can remain embedded within a modern cloud architecture and support multiple newer services.
The critical questions for technology and risk teams are therefore:
- What systems depend on each critical service?
- How far can a failure propagate?
- Can individual components be isolated?
- What happens when a dependency becomes unavailable?
- Can critical business processes operate in a degraded mode?
- How quickly can services and data be reconciled after recovery?
These questions are increasingly important for banks, insurers and other financial institutions that rely heavily on cloud-based infrastructure.
Implications for Risk Management
For financial institutions, cloud outages can affect customer service, payments, underwriting, claims, trading, regulatory reporting and internal operations, depending on the systems involved.
Cloud concentration also creates third-party risk. If several critical business functions depend on the same provider or technology ecosystem, a single disruption can potentially affect multiple processes simultaneously.
Risk teams therefore need to look beyond individual vendor assessments and examine concentration risk, dependency risk and failure propagation.
Business continuity plans should also test realistic cloud failure scenarios rather than assuming that cloud infrastructure automatically provides sufficient resilience.
The Salesforce incident provides a practical reminder that technology modernisation should be measured not only by how much legacy infrastructure has been replaced, but also by dependency concentration, isolation, graceful degradation and recovery capability.
For insurers and risk professionals, the broader lesson is particularly relevant: as businesses become increasingly dependent on cloud platforms, cloud availability itself becomes an insurable and operational risk.
Want to deepen your expertise beyond today’s news?
Explore practical certification courses designed for banking, risk, insurance, compliance, ESG, AI, and emerging technologies professionals.
Learn from industry experts and earn certifications from RMAI and BFSI Sector Skill Council of India.
#Riskmanagementnews
