8.5 million Windows machines blue-screened in under 90 minutes. The cause wasn't malware — it was a file with a 21st field that the kernel still expected to have 20. On July 19, 2024, CrowdStrike's cloud validator approved an update against a new 21-field schema. The interpreter in the Windows kernel — Ring 0 — was still built for 20. Out-of-bounds read, instant BSOD, every endpoint at once. Then came the part nobody plans for: the crash hit so early in boot that the agent meant to receive the rollback never loaded. A dead-agent loop — no remote fix possible. IT teams booted each machine into Safe Mode by hand to delete the faulty driver. Delta did it across 40,000 servers — 7,000+ flights cancelled, five days, $550M lost. The uncomfortable detail for anyone renegotiating a vendor contract this year: Delta had opted out of auto-updates. The channel file reached the kernel anyway. In May 2025 a court let claims for gross negligence and computer trespass proceed past CrowdStrike's liability cap — because settings you control at the UI mean nothing if a vendor can push Ring 0 content underneath them. A typical enterprise endpoint runs 8–12 kernel-level agents — EDR, DLP, encryption, patching, VPN, MDM — each on its own update channel, each waved through by a change advisory board that reviews internal deployments but trusts the vendor. SBOM and SCA tools audit open-source dependencies, not proprietary config pushes. There is no independent layer between a vendor's update pipeline and your production fleet. At a median $2M per hour of downtime, "we trust the vendor" is now a line item the board can price. CrowdStrike kept 97%+ gross retention through all of it — the market didn't punish the vendor, so the burden lands on you. Pull your last 12 months of vendor updates: how many actually went through your CAB, and how many got waved through because the vendor's name was on them? #ITResilience #CyberResilienceAct #EndpointSecurity #SoftwareSupplyChain #CISO