Too many eggs in one basket?

Every banker understands the dangers of putting too many eggs in one basket. It's one of the most basic principles of risk management. Diversify your exposures, spread your risks and never become too dependent upon a single counterparty.

So why are we doing exactly the opposite with technology?

It's a question I've been asking myself recently, as one technology failure after another reminds us just how dependent we have become on systems we don't understand, cannot control and have no alternative to.

In June, Worldpay suffered an outage that left pubs and shops unable to accept card payments. Imagine standing at the bar during an England football match, ordering a round of drinks, only to discover that they will only take cash. Who has cash these days? You've got money in the bank, but the system says no.

Then, in October, Revolut and other banks suffered disruption linked to Google Cloud. Customers experienced problems accessing banking services and making payments.

Then, Microsoft suffered an outage affecting Outlook and other services last week. No emails. No messages. No way to communicate through the systems we depend upon every day.

Three different incidents, three different technologies and the same fundamental problem. We have put all of our digital eggs into just a few technology baskets.

The experts have some basic advice, such as always carrying cash in case your cards stop working, having a telephone available in case email goes down and making sure you have backup systems in case your primary systems fail.

Sounds sensible … except that I don't carry cash anymore. Why would I? Everywhere accepts cards or mobile payments. As for telephoning someone when email stops working, there's another problem. I've no idea what your telephone number is. I probably have it somewhere in a contact database synchronised with my cloud services but, if the cloud service is down, how can I find your number?

In 2026, all of these things depend upon the digital infrastructure, but is challenged when that infrastructure has stopped working.

This is the paradox of digital transformation. We have spent decades removing friction, eliminating paper, replacing physical processes and moving everything into the cloud. We have celebrated the convenience, efficiency and cost savings, but in making everything digital, we have also made ourselves extraordinarily dependent upon a handful of technology providers.

I've talked about this before, and it is becoming increasingly clear that we have created a massive systemic concentration risk in our technology infrastructure.

Consider cloud computing.

Much of the world's digital infrastructure is now concentrated in companies like Amazon, Microsoft, Alphabet and Oracle. These companies provide extraordinary capabilities but the more that organisations move their critical operations onto the same platforms, the greater the consequences when one of those platforms fails.

The issue is not that cloud computing is inherently unreliable. In many respects, it is considerably more resilient than the technology banks operated themselves. The issue is that thousands of organisations now depend upon the same infrastructure, creating common points of failure across industries, countries and entire economies.

A failure that once affected one bank can now affect dozens of banks, payment providers and financial institutions simultaneously.

That is the difference between operational risk and systemic risk. One institution failing is a problem for that institution and its customers. A shared technology provider failing across multiple institutions becomes a problem for the financial system and, when you think that governments, hospitals, retailers, airlines and more all run on the same systems, you have the collapse of the economic system.

There is something deeply ironic about this.

Banks have spent decades developing sophisticated systems to measure credit concentration, counterparty exposure, liquidity risk and market risk. They know exactly what happens when too much money is exposed to one borrower, one industry or one country. Yet, when it comes to technology, they have collectively concentrated critical services among a handful of providers. Individually, each bank can justify the decision. Collectively, they are creating a systemic vulnerability.

Every bank thinks it has diversified its risk but, instead, the banking system is putting more eggs into the same baskets.

For banks, this is particularly serious because banking is not just another digital service. If Netflix goes down and you cannot watch a film, that's okay. I can switch to Amazon Prime. If your bank goes down and you cannot access your money, pay your bills or run your business, that’s not okay. The consequences are fundamentally different.

Banks have spent billions transforming their technology, migrating to the cloud, automating processes and closing branches. They have become more efficient, more accessible and more digital, but have they become more resilient?

The question is not whether a bank has a disaster recovery plan. Of course it does. The question is whether it has a business continuity plan that genuinely works.

Disaster recovery is about restoring technology after something goes wrong. Business continuity is about keeping the business operating while systems are unavailable.

How often do banks test what happens when everything fails? How often do they test their backup systems? How often do they check that their business continuity plans work in practice rather than just on paper? More importantly, how often do they test what happens when several things fail together?

A bank might have two cloud providers, but what if both rely upon the same telecommunications network? It might have alternative payment systems, but what if both depend upon the same processor? It might have a customer contact centre, but what happens when its telephone systems, customer records and internal communications all depend upon the same technology infrastructure?

These are not just technology questions. They are questions about the architecture of the entire banking system.

The biggest vulnerability is increasingly not within the bank itself, but in the network of third parties upon which the bank depends. Cloud providers, payment processors, telecommunications companies, identity platforms and software vendors have become critical parts of financial infrastructure, yet a failure at one of them can affect dozens of banks simultaneously.

Just to add more eggs to the same basket, we are repeating the same mistake with artificial intelligence.

We have concentrated our cloud infrastructure among a handful of providers, and we are building the next generation of intelligent banking services on top of those same platforms and an equally concentrated group of AI companies.

Banks are racing to become AI-native, embedding artificial intelligence into customer service, fraud detection, credit decisions, compliance, risk management and now the execution of financial transactions themselves. What happens when the AI service goes down? Imagine a cloud and AI outage at the same time, what can the system do? It’s like electricity. If you break the cable, nothing works.

Imagine a bank that has automated its customer service using one AI provider, its fraud monitoring using another and its internal operations using a third. It looks diversified, but what if those providers depend upon the same underlying cloud infrastructure, computing resources or network services?

What looks like diversification at the application level can be concentration at the infrastructure level. A bank might use five different AI suppliers, but if they all depend upon the same underlying cloud platform or foundation model, how many baskets does it really have?

Worse, what happens when the AI systems are working perfectly, but the services they depend upon are unavailable? An autonomous payment agent cannot execute a transaction if the payment infrastructure is down. An AI fraud detection system cannot protect customers if it cannot access transaction data. An AI customer service agent cannot answer questions about accounts if the bank's core systems are inaccessible.

We are building increasingly intelligent systems on top of increasingly concentrated infrastructure and the more intelligent and autonomous our financial systems become, the more dependent they become upon the availability of a handful of technology providers.

This is where systemic concentration risk becomes particularly worrying. Banks can diversify their suppliers, but that does not mean they have diversified their underlying dependencies. Five different AI applications could all rely upon the same cloud provider, the same foundation model or the same critical infrastructure.

We call this operational resilience, but resilience cannot be measured solely by how quickly systems are restored. It should be measured by whether customers can still access essential services while those systems are unavailable.

It also means that regulators need to look beyond individual banks and examine the concentration of dependencies across the financial system. If hundreds of institutions depend upon the same cloud platforms and AI providers, testing the resilience of each institution independently will not reveal the full extent of the systemic risk.

This is particularly important as we move towards agentic commerce and autonomous payments, where machines increasingly make decisions and execute transactions without human intervention. What happens when those systems stop working and the humans cannot take control? Do we even have the people, processes and knowledge to operate manually anymore?

A bank that is digital at the core, but cannot operate when digital fails, has a fundamental problem. An AI-native bank that cannot function when its AI services fail has an even bigger one.  We are not going back to paper ledgers, cheque books and filing cabinets, but we need to recognise that in removing the old systems, we have also removed many of the escape routes. So, the next time someone tells you to carry cash and use the telephone as a backup, ask them: how do I find your telephone number when everything is down?

We've made everything connected, but we've forgotten how to function when we're disconnected.