In a prior role, we realized something similar with outages. For our particular product, we AWS went down - we went down. We freaked out the first time, but after it was done we realized not a single customer had inquired. This felt unusual since we were getting emails quickly if we have a self-inflicted outage.

Turns out, when a major provider went down all of our users were too busy fighting their own fires. When they do notice, it's on a day when ALL of their vendors are struggling so we don't get singled out as a bad apple.

The whole "No one gets fired for using IBM" analogy.

This is especially true if the majority of your customers are also on Microsoft/AWS/etc.

Literally 0 of your customers will notice that you are down if their own systems are also not working.

This is perfectly valid for many businesses, up to a (shockingly high) level.

It's today's "nobody ever got fired for buying IBM". You're really just want the the SLA (someone to blame when things inevitably fail)

Yeah, if Exchange goes down, you get a day off. If the little boutique email provider you chose goes offline, you get a day in calls with everyone yelling at you.

If you need deniability, sure.

But it you actually NEED security, it's clearly not an option.

You are just describing how they're a more valuable target for an attack.

Having crippling bureaucracy does not correlate with good security outcomes, except maybe negatively. However, having a history of unending egregious security failures, like Microsoft, does correlate with poor security outcomes. For that matter, having a present of unending egregious security failures also correlates with poor security outcomes.

Let us look on the front page and see if there are any, oh look here is one: https://www.binarysecurity.no/posts/2026/10/one-root-case

Practically every software security firm in the country was a vendor to Microsoft in the mid-late oughts and I know the Microsoft you're speaking about, but the vibe I've got lately is that things are different there now.

Tell me you weren’t on the Windows team without telling me you weren’t on the windows team :)

For me, the truth. I’d like the most secure provider possible. Which one is it though?

[dead]

Adding on to it, even though they may be using AI as well. This could very well be a placebo and deniability factor but the fact remains that they have many many qualified employees and the chances of bugs passing through that are much less compared to other systems. Also it's that the systems are very severely pen-tested and have years of bugs removed out and the incentive of billions of dollars at stake that you mention that they have for the trust premium.

They will still make mistakes but they have the resources to make them less.

I doubt that such intense level of thorough testing can occur in a smaller company.

I still love small VPS providers and use them myself but it is worth knowing why enterprise is willing to pay a premium over those to these hyperscalers (it is a trust premium)