UK firms face major cloud outage risk, report says

The Cyber Monitoring Centre and Parametrix have published a report on UK exposure to cloud infrastructure failure. The study finds that more than 60% of UK companies depend on cloud services for critical functions.

Dependence rises to more than 80% among FTSE 100 companies, suggesting outages could hit some of the country's largest businesses hardest. The report also identifies two Amazon Web Services regions - eu-west-1 in Dublin and us-east-1 in Northern Virginia - as the main aggregation points where failures could cause broad economic disruption.

A 24-hour outage in the Dublin region could lead to an estimated £1 billion in lost revenue for directly affected companies. In Northern Virginia, the estimated loss is £650 million.

These figures cover only businesses directly using the affected cloud regions. They do not include knock-on effects for customers, dependent firms, or supply chains.

The research examined cloud usage across UK companies of different sizes and sectors as part of the Cyber Monitoring Centre's work on the financial impact of major cyber incidents. Among organisations using the cloud, it found that 80% depend on services from AWS, Microsoft Azure, and Google Cloud Platform.

Exposure is unevenly spread across the economy. Half of FTSE 100 companies rely on cloud regions in the UK and Ireland, while the other half are exposed to regions outside the UK.

Smaller businesses are more reliant on UK and Ireland regions, while larger companies tend to spread their cloud usage across several continents. That broader footprint may reduce concentration in one geography, but it also leaves many large firms exposed to outages beyond domestic infrastructure.

Sector exposure

The report highlights particularly high levels of cloud dependency in health and technology-related fields. Among large companies and FTSE 100 groups, dependency is highest in Health at 91% and Software & IT Services at 90%.

Finance and Transportation both stand at 76%. Manufacturing, Retail and Wholesale, and other sectors are lower at 57% to 66%, though their economic size still creates substantial exposure.

The findings come as cloud services play a growing role in day-to-day business operations, from data storage and software delivery to internal systems and customer-facing platforms. The concentration of that activity in a relatively small number of service providers and regional data hubs has become a focus for companies, insurers, and policymakers assessing operational risk.

Will Mayes, Chief Executive Officer of The Cyber Monitoring Centre, placed the report's conclusions in the context of broader adoption across the economy.

"This paper has been developed at an important stage in the UK's adoption of cloud computing. Nearly 80% of companies in the UK with more than £50 million of revenue are reliant on cloud infrastructure and many of these use the cloud for business critical operations. Mapping out cloud data usage provides a valuable starting point for the CMC's analysis of future cloud failure events. Actual losses would likely end up being significantly higher when accounting for the knock-on impacts to customers of cloud users, and this will be an important element of our analysis if a major cloud outage occurs. The findings reveal a UK economy which is increasingly dependent on cloud infrastructure, with exposure concentrated at a small number of critical aggregation points. This concentration creates systemic vulnerabilities that require coordinated action from companies, insurers, regulators, and policymakers to manage effectively. This isn't about stepping back from the cloud; it's about recognising that cloud is now part of our critical infrastructure and designing, governing and investing accordingly."

Risk mapping

The Cyber Monitoring Centre is a non-profit organisation that analyses and categorises cyber events affecting UK organisations. Its work aims to improve understanding of the scale and financial consequences of major digital disruptions.

Parametrix specialises in insurance tied to digital infrastructure downtime. Its involvement in the study reflects growing interest from the insurance market in measuring the business impact of outages affecting shared technology platforms.

Sharon Haran said many organisations still lack visibility into the depth of their cloud exposure.

"Cloud services have become one of the most important layers of critical infrastructure, yet most organisations have only a limited understanding of where their dependencies actually lie. You can't manage, monitor, or transfer a risk that you haven't first identified and quantified. We're proud to partner with the Cyber Monitoring Centre on this analysis, which gives UK businesses a clearer picture of where cloud exposure is concentrated and what a major outage could mean for both individual organisations and the UK economy."