Summary

• The Cyber Monitoring Centre and Parametrix have published analysis on UK exposure to cloud infrastructure failure.
• The report says more than 60% of UK companies depend on cloud services for critical functions, rising above 80% among FTSE 100 companies.
• A 24-hour outage in major AWS regions could create hundreds of millions to £1bn in direct revenue losses for affected UK companies.

The Cyber Monitoring Centre and Parametrix have put new figures on the UK’s dependence on cloud infrastructure, estimating that a 24-hour failure in major cloud regions could cause direct revenue losses of between hundreds of millions of pounds and £1bn for affected British companies.

Their report, The Cost of Downtime: UK Exposure to Cloud Infrastructure Failure, maps the UK economy’s reliance on cloud services and the systemic risk created by concentration around major providers and regions. CMC says more than 60% of UK companies depend on cloud services for critical functions, rising to more than 80% among FTSE 100 companies.

The analysis estimates that a 24-hour outage in AWS’s Dublin region could produce around £1bn in direct lost revenue for affected UK companies, while an outage in Northern Virginia could produce around £650m. Those figures cover directly affected companies and do not include wider knock-on effects across customers, suppliers, and dependent organisations.

Cloud concentration is not a new concern, and it should not be framed as one. Regulators, insurers, resilience specialists, and large technology buyers have warned for years that dependence on a small number of hyperscale providers can create aggregated risk. The CMC and Parametrix analysis adds a sharper economic model to a recognised problem, showing where exposure sits and how outage losses could accumulate across the UK economy.

That distinction changes board discussions. Cloud resilience is often treated as a technical architecture question: multi-region design, backups, disaster recovery, incident response, and service-level agreements. Yet when many large companies depend on the same provider regions, the risk becomes systemic. An outage can affect multiple sectors at once, including retail, finance, logistics, software, media, healthcare suppliers, and government-facing services.

Cloud adoption has delivered clear operational benefits. It has lowered infrastructure barriers, improved scalability, accelerated software deployment, and supported the shift to data-heavy and AI enabled services. The problem is that efficiency and concentration have moved together. Many organisations have reduced internal infrastructure complexity by depending more heavily on a small number of external platforms.

That trade-off becomes sharper as AI workloads grow. More companies are moving data processing, model deployment, analytics, and customer-facing automation into cloud environments. AI services also create deeper dependencies on specialist infrastructure, GPUs, managed model platforms, APIs, and data pipelines. An outage affecting a major region can therefore disrupt not only websites or apps, but the automated workflows and decision systems that now sit behind business operations.

The insurance angle is also important. Parametrix specialises in cloud outage risk analytics, and the CMC was created to help classify and understand the impact of cyber events on the UK economy. As modelling improves, cloud downtime may become more visible in insurance pricing, risk transfer, and contractual negotiations. Companies that cannot demonstrate resilience may face higher premiums, weaker coverage, or tougher customer requirements.

Technology buyers should be wary of simple answers. Running across multiple providers can reduce dependency, but it is expensive and operationally complex. Multi-region design helps, but not all services fail neatly, and some dependencies are hidden in identity systems, databases, queues, monitoring, payments, analytics, or third party SaaS tools. A company may believe it has diversified while still relying on the same underlying region or provider through suppliers.

Regulators are already paying closer attention to critical third parties, particularly in financial services. The CMC analysis broadens the concern because cloud concentration affects the wider economy. If cloud outages can produce large direct revenue losses for UK companies, resilience is not only a matter for CIOs and security teams. It becomes part of operational risk, customer service, economic continuity, and national infrastructure policy.

The report does not support a retreat from cloud. That would be unrealistic and commercially damaging for many organisations. It does point towards more disciplined dependency mapping, scenario testing, exit planning, supplier transparency, and investment in recovery capabilities. The cloud has become part of the UK’s business infrastructure. The next phase is making sure that infrastructure can fail without taking too much of the economy with it.