Microsoft says CrowdStrike outage affected many more devices than reported

Believe it or not, it's been 10 days since a global computer outage took down some of the world's biggest companies.

The issue was caused by an error in a software update from CrowdStrike, a third-party cybersecurity company. Since all of the affected devices were Windows-based PCs, Microsoft faced criticism for the outage, too.

In a new blog post over the weekend, Microsoft shared its own analysis of the CrowdStrike situation and offered solutions to ensure an outage of this scale doesn't happen again.

However, one interesting piece of information in the blog post, as noticed by TechRadar, is that Microsoft claims that the number of reported affected devices was vastly underestimated.

CrowdStrike outage impacted more devices than initially reported

One day, after the CrowdStrike outage, Microsoft reported that 8.5 million Windows machines were affected by the error in the cybersecurity company's software update. 

Now, in its latest update, Microsoft has shared that the 8.5 million number is just a small "subset" of devices actually affected. Microsoft did not share the actual estimated number of affected Windows devices. But, it clearly seems to be many millions more than it previously revealed.

According to Microsoft, the 8.5 million figure that was shared came from devices that shared crash reports with the company. Crash reports are an optional feature, which automatically lets Microsoft know when a system encounters an error. If a consumer or company decides not to share crash reports with Microsoft, the company isn't pinged with the issue. As such, they would not be counted in the affected devices estimate.

While most of the millions of Microsoft computers have been fixed at this point, the industry is still gripping with how this could have been allowed to happen.

Microsoft's next steps

The reason why the CrowdStrike update error caused so much damage was because it runs at the kernel level, which is the core part of the operating system. This is why when the update error occurred, it didn't just affect CrowdStrike's software. It took the whole computer system down, too, resulting in the dreaded Windows blue screen of death.

Microsoft explained in its post the reasons why cybersecurity software tends to operate at the kernel level, but clearly, after this latest debacle, that approach needs to be reconsidered.

According to Microsoft, the company is currently looking at "reducing the need for kernel drivers to access important security data." Along with that, the company will also be working with third-party vendors to ensure they follow the best practices when rolling out updates. so that they can catch issues before they go live.

According to CrowdStrike, as of last Thursday, 97 percent of affected devices are back online.