Security issues remain top cause of outages

Source: Svitlana/Technology/Adobe Stock.

Organizations continue to favor cloud-based data protection methods, with less than a third of respondents maintaining an on-premises-only strategy. With the average cost of outages consistently in the millions of dollars, data protection offerings must accelerate recovery times. Additionally, many respondents still say recovery requires significant effort, highlighting the need for enhanced disaster recovery testing. Meanwhile, data protection for SaaS applications continue to rise in importance. The study conducted by S&P Global Market Intelligence 451 Research was fielded in March and April 2025.

The Take

Disaster recovery remains challenging for organizations, with security threats such as ransomware again cited as the most common cause of outages. The high cost of outages — averaging in the millions of dollars — is driving organizations to leverage hybrid and cloud offerings such as online backup and disaster recovery as a service to improve recovery point objectives and recovery time objectives.

The effort required to recover after a failure is increasingly concerning, with 35% saying it took significant effort to restore primary systems, versus 27% a year ago. Increased testing frequency for disaster recovery processes and expanded use of automation could improve the speed and consistency of recoveries.

Data protection for SaaS assets such as Office 365, Google Workspace and Salesforce continues to rise in importance. Organizations are leveraging both third-party data protection offerings and services from the SaaS vendors themselves to mitigate the risk of data loss or corruption in SaaS platforms.

Summary of findings

Outages remain costly. The mean reported cost per outage is just over $2 million, marking a slight decrease from $2.3 million in the 2024 study. In the latest survey, 35% of outages reportedly cost more than $1 million, and 3% of respondents say their most recent outage cost more than $10 million. Common consequences of outages include lost worker productivity, data loss, lost revenue and damaged organizational reputation.

Security issues, software failures and cloud service failures are the top causes of recent outages. Security issues are cited as the leading cause of outages (23% of respondents), just ahead of software failures (22%). Cloud or SaaS failures are cited by 19% of respondents, highlighting the need for comprehensive data protection that can function across highly distributed hybrid and multicloud environments.

Cloud-based data protection continues to rise. Hybrid cloud deployments are the most popular choice for data protection (37% of respondents), edging out purely cloud-based services such as online backup and DRaaS (33%). Organizations maintaining on-premises-only deployments remain in the minority at 30% — up a bit from 25% in 2024, but down from 34% in 2023.

Recovery operations remain challenging for most. Just over a third of respondents (35%) say it took significant effort to restore primary systems after an outage, up from 27% in the prior-year survey. An additional 45% say it took moderate effort to complete their recovery. Enhanced disaster recovery testing and orchestration could help improve the speed and consistency of recovery operations, though more than 8% of respondents say they never test their disaster recovery or do not have a DR plan.

Protection of SaaS data continues to evolve. Nearly a quarter of respondents (22%) are using third-party cloud-to-cloud data protection for their SaaS data, while 46% use their cloud vendor for data protection. Only 2% of respondents say they are not backing up their SaaS applications, marking an improvement from 5% a year ago and 6% in the 2023 study. When asked for which SaaS platforms they would consider purchasing a backup service, respondents most often cite Microsoft Office 365 (67% of respondents), followed by Google Workspace (52%) and Salesforce (45%).

Want insights on Infosec trends delivered to your inbox? Join the 451 Alliance.