The July 19, 2024 CrowdStrike outage is among the largest IT outages on record. Microsoft estimated that CrowdStrike's faulty update affected 8.5 million Windows devices, or less than one percent of all Windows machines. No authoritative figure exists for the global cost. The estimate cited most often comes from the insurer Parametrix, which put direct financial losses for US Fortune 500 companies (excluding Microsoft) at about $5.4 billion in an analysis published on July 24, 2024. That number covers only those companies. It is an estimate, not a measured total for the world economy.

This article covers what happened, what the outage cost according to the best available sources, what CrowdStrike and Microsoft changed afterward, and what it means for monitoring. Each figure names its source and year.

What happened on July 19, 2024

At 04:09 UTC on July 19, 2024, CrowdStrike released a content update to Channel File 291, which controls how its Falcon sensor evaluates named pipe execution on Windows. According to CrowdStrike's root cause analysis, the new template type defined 21 input fields, but the sensor's integration code supplied only 20 values. When the new content tried to read the 21st value, the result was an out-of-bounds memory read and a system crash. The mismatch had passed several layers of validation and testing, partly because earlier tests used a wildcard for the 21st input.

CrowdStrike says the update was remediated at 05:27 UTC, 78 minutes after release. Windows hosts running Falcon sensor 7.11 or later that were online during that window could be affected. The root cause analysis includes a crash dump with the stop code PAGE_FAULT_IN_NONPAGED_AREA, and CrowdStrike's own post describes the result as a blue screen on impacted systems.

Recovery was manual. Microsoft's guidance told administrators to restart each affected device into Safe Mode, open the CrowdStrike drivers folder and delete files matching C-00000291*.sys. On BitLocker-protected devices the screen could ask for a BitLocker recovery key, so teams needed access to those keys before they could start. In prepared testimony to Congress on September 24, 2024, CrowdStrike's Adam Meyers said that approximately 99% of Windows sensors were back online as of July 29.

What the outage cost

Every figure in this section is an estimate for a specific group of companies. Parametrix's analysis covers US Fortune 500 companies, excluding Microsoft. It estimated direct losses of $5.4 billion in total, with the largest share in healthcare ($1.938 billion), followed by banking ($1.149 billion). It put the loss for the six Fortune 500 airlines at approximately $860 million. Parametrix does not give a global figure.

Aviation was the most visible sector. FlightAware counted about 4,400 cancelled flights as of 6:30 p.m. ET on July 19, and TechCrunch noted that not all of those were linked to the outage. Delta was hit hardest. In its Form 8-K of August 8, 2024, Delta reported approximately 7,000 flight cancellations over five days. It estimated a direct revenue impact of $380 million and non-fuel expense of $170 million, partly offset by fuel expense $50 million lower, which nets to about $500 million. Delta said it was pursuing legal claims against CrowdStrike and Microsoft and put the damages at a minimum of $500 million. In May 2025 a Georgia state court judge allowed most of Delta's claims against CrowdStrike to proceed, including gross negligence and computer trespass. The claimed amount is not a judgment.

Insurance covered only a fraction. Parametrix estimated that the portion of the Fortune 500 loss covered by cyber insurance policies was no more than 10% to 20%, and gave an insured loss range of $540 million to $1.08 billion. CyberCube's preliminary estimate, reported by Reinsurance News on July 25, 2024, was $400 million to $1.5 billion for the standalone cyber insurance market. Both are July 2024 estimates of insured losses, not reported payouts.

CrowdStrike's response and recovery

Investors reacted quickly. A shareholder lawsuit filed in federal court in Austin, Texas, alleged that CrowdStrike's share price fell 32% over the 12 days after the outage, wiping out $25 billion of market value (Reuters, August 1, 2024). Those figures come from the complaint, not from an independent calculation.

Customers largely stayed. In its results for the quarter ended January 31, 2025, CrowdStrike reported 97% dollar-based gross retention. In its results for fiscal 2026, announced March 3, 2026, it reported annual recurring revenue of $5.25 billion as of January 31, 2026, up 24% year over year, and total revenue of $4.81 billion, up 22%. These are the company's own figures. They show that customers kept buying, not that the outage had no cost.

CrowdStrike's root cause analysis committed to specific changes. Each new template instance is to be deployed in a staged rollout: instances that pass canary testing are promoted through successively wider deployment rings, with bake-in time and telemetry between rings. The analysis also says customers can now choose where and when Rapid Response Content updates are deployed, and that CrowdStrike engaged two independent third-party security vendors to review the Falcon sensor code. On September 30, 2025, CrowdStrike appointed Amjad Hussain as Chief Resilience Officer, reporting directly to CEO George Kurtz. In July 2025 the company announced that Gartner had named it a Leader in the 2025 Magic Quadrant for Endpoint Protection Platforms for the sixth consecutive time.

What changed outside CrowdStrike

On September 10, 2024, Microsoft hosted the Windows Endpoint Security Ecosystem Summit with endpoint security vendors and government officials from the US and Europe. Microsoft wrote afterward that customers and ecosystem partners had called on it to provide additional security capabilities outside of kernel mode, and that the summit was not a decision-making meeting. On June 26, 2025, Microsoft said it would deliver a private preview of the Windows endpoint security platform to a set of partners the following month, so that antivirus and endpoint protection products can run in user mode, as apps do.

The outage also showed how many organizations relied on one vendor. Meyers told Congress that CrowdStrike's platform protected 298 Fortune 500 firms as of April 30, 2024. We did not find a published measure of how many organizations changed security vendors, update policies or monitoring afterward, so this article does not claim an industry-wide shift.

Congress, regulators and litigation

The House Homeland Security Committee's Subcommittee on Cybersecurity and Infrastructure Protection held a hearing on September 24, 2024 titled “An Outage Strikes: Assessing the Global Impact of CrowdStrike's Faulty Software Update”. Adam Meyers, CrowdStrike's Senior Vice President for Counter Adversary Operations, was the witness. His prepared testimony said: “we let our customers down” and “We are deeply sorry this happened and are determined to prevent it from happening again.”

On July 23, 2024 the US Department of Transportation said it was investigating Delta Air Lines over its flight cancellations after the outage. CrowdStrike's quarterly report for the period ended April 30, 2025, filed on June 4, 2025, discloses that the company has received requests for information from the US Department of Justice and the Securities and Exchange Commission relating to its recognition of revenue and reporting of annual recurring revenue for transactions with certain customers, the July 19 incident and related matters. The company says it is cooperating.

Vendor-side outages did not stop in 2025

At the one-year mark, the lesson was already clear: your systems can fail because of a change you did not make. On May 29, 2025, SentinelOne reported a global service disruption that left security teams unable to reach its management console. The cause was a software flaw in an infrastructure control system that removed network routes. SentinelOne said customer endpoints stayed protected and that it was not a security incident. On June 12, 2025, Google Cloud had an outage that began with a policy change containing blank fields, which crashed its Service Control component. The same day, Cloudflare reported that its Workers KV service failed because part of its storage infrastructure is backed by a third-party cloud provider that was also having an outage.

A PagerDuty survey of 1,000 IT and business executives in the US, UK, Australia and Japan, published on December 11, 2024, found that 88% of respondents believed another major incident would occur in the next 12 months.

What this means for monitoring

This section is our view, not a statistic. In an incident like this one, your own machines can go down, and so can the tools that live inside your network. A monitor that runs on separate infrastructure and checks your public endpoints from outside still reports what your customers see, and it can alert you through channels that do not depend on the affected systems. Site Qwality runs HTTP, TLS and DNS checks and sends alerts by email, SMS, Slack, Microsoft Teams or webhook. HTTP checks run from one location on the free tier and from as many locations as you choose on paid uptime plans.

Monitoring does not stop a bad vendor update from crashing your endpoints. It shortens the time before you know that something is wrong and gives you an independent record of when it started and ended. Site Qwality does not offer TCP, ICMP or port checks.

What to take from it

The sources above support three practical points. CrowdStrike's own root cause analysis adopted staged rollouts and customer control over update deployment, so ask your own vendors whether you can control when their updates reach your systems. Recovery depended on access to BitLocker recovery keys, so confirm that you can reach yours when the machines that normally serve them are down. And keep at least one independent view of your public services, so that you learn about an outage from a monitor and not from a customer.

For organizations that want that independent view, Site Qwality has a free tier with 5-minute checks, and paid uptime plans check as often as every 30 seconds. Start monitoring your public endpoints from outside your own infrastructure.

Sources