What Microsoft's November 12 outage teaches us about technology, shared responsibility, and the importance of education.
Yesterday's Microsoft 365 outage had me thinking about something I've believed for a long time: We need to have a bigger conversation about technology responsibility.
When technology stops working, businesses can lose access to email, employees struggle to communicate, and the systems we depend on to operate suddenly become unavailable.
Naturally, everyone looks to IT to fix the problem.
But here's my question: Who is really responsible?
Is it Microsoft? The IT department? The cybersecurity team? Business leadership? Or the employees who rely on these systems every day?
The reality is that technology responsibility exists at multiple levels. And too often, we don't fully understand those responsibilities until something goes wrong.
Technology Is the Coin: IT Support and Cybersecurity Are Two Sides of It
I've always looked at technology as a coin.
IT support is one side. Cybersecurity is the other. But they're still part of the same coin.
IT support focuses on keeping technology operational, troubleshooting issues, maintaining infrastructure, and ensuring systems function as intended.
Cybersecurity builds upon that technical foundation, focusing on protecting systems, information, and the people who depend on them.
The two disciplines require different skills and specialized knowledge, but they are deeply connected.
Cybersecurity relies on IT. You cannot effectively secure something you don't understand.
Think about it.
How can you secure a network if you don't understand how devices communicate? How can you identify vulnerabilities in a system if you don't understand how it's configured? How can you protect an environment if you don't know what normal operations look like?
Understanding how technology works is fundamental to understanding how to protect it.
But there's another side to this conversation.
Just because someone knows how to fix a computer doesn't automatically mean they understand cybersecurity.
A technician may be excellent at troubleshooting hardware, restoring connectivity, or resolving software problems. Those are valuable skills, but they don't automatically translate into understanding cyber threats, vulnerabilities, risk management, or security architecture.
Likewise, cybersecurity knowledge alone doesn't necessarily mean someone has the hands-on experience to troubleshoot or maintain every system they're responsible for protecting.
This is where education, experience, and collaboration become essential.
IT professionals need to understand how their technical decisions affect security. Cybersecurity professionals need to understand the systems and operational environments they're protecting.
For example, cybersecurity may identify a vulnerability, but IT is often responsible for implementing the fix. IT may restore a system after an outage, but cybersecurity helps ensure that the solution doesn't introduce unnecessary risk.
IT makes technology work. Cybersecurity helps ensure it works securely. Neither should operate in isolation.
Yet somewhere along the way, we've created too much separation between two disciplines that fundamentally depend on each other.
And that separation can create gaps in both knowledge and responsibility.
The Technology Responsibility Model: Understanding Who Owns What
Microsoft's November 12 incident reminds us that technology responsibility extends far beyond the person answering the help desk phone.
There are multiple layers of responsibility, and each plays an important role.
1. Technology Providers
Companies like Microsoft are responsible for the infrastructure and services they provide, including service availability, security, maintenance, monitoring, and incident response.
Businesses depend on these services, but they don't control the underlying infrastructure.
When those services experience problems, the impact can reach thousands of organizations that have little control over resolving the original issue.
2. IT Professionals and Service Providers
IT teams are responsible for maintaining technology environments, troubleshooting issues, managing configurations, and supporting business operations.
But their responsibility shouldn't end once a computer turns on or an application starts working again.
They must also understand how their decisions affect system reliability, security, and business continuity.
Getting something working is important. Understanding whether it's configured properly and securely is equally important.
3. Cybersecurity Professionals
Cybersecurity teams focus on identifying vulnerabilities, assessing risks, implementing security measures, monitoring threats, and preparing for incidents.
However, effective cybersecurity requires more than knowing which security products to install.
It requires an understanding of the systems, infrastructure, and business operations being protected.
Without that technical foundation and collaboration with IT, even well-intentioned security decisions can create operational challenges or leave critical gaps.
4. Business Leadership
This is one of the most overlooked levels of responsibility.
Business owners and executives must recognize that technology isn't simply an IT expense. It's a business dependency.
Leadership is responsible for understanding organizational risks, providing resources, establishing expectations, and ensuring that plans exist when technology fails.
Outsourcing IT support or cybersecurity services does not eliminate a business owner's responsibility for managing organizational risk.
5. Employees and Everyday Users
Employees also have a role in protecting the technology they use.
They need to understand how to recognize suspicious activity, protect their accounts, report concerns, and respond when systems become unavailable.
But we cannot expect employees to make informed security decisions if we haven't provided them with the education and guidance to do so.
Responsibility must be supported by education, not simply assigned through a policy.
Each level has different responsibilities, but none operates independently of the others.
Education Is What Connects the Two Sides
One of the biggest challenges I see in technology is that we often teach people how to complete a task without explaining why that task matters.
We teach employees how to reset passwords, but do we explain the importance of protecting their identities?
We teach technicians how to troubleshoot systems, but do we help them understand how their changes might introduce security risks?
We invest in cybersecurity tools, but do the people responsible for monitoring those tools understand the environments generating the alerts?
And when businesses purchase additional security products, do they understand what those products actually protect, how they work together, and who is responsible for managing them?
Education shouldn't stop at knowing how to complete a task. It should include understanding how that task affects the entire technology environment.
This doesn't mean every IT professional must become a cybersecurity expert or every cybersecurity professional must become a help desk technician.
Specialization matters. We need people with deep expertise in both disciplines.
But specialization should never become isolation.
Professionals should understand the fundamentals of the systems they work with, recognize where their responsibilities intersect, and know when to involve someone with additional expertise.
We should be encouraging continuous learning, shared knowledge, and collaboration rather than treating IT support and cybersecurity as completely separate worlds.
Because a strong cybersecurity program cannot exist without a reliable technical foundation, and a reliable IT environment shouldn't exist without security being part of its design and maintenance.
What the Microsoft Outage Should Teach Businesses
Microsoft's November 12 disruption affected several Microsoft 365 services, including Outlook and Teams, demonstrating just how dependent organizations have become on cloud-based technology.
Microsoft reported no indication of a cyberattack, which makes this an important distinction.
Not every technology incident is a cybersecurity attack. But every major technology disruption should prompt a conversation about resilience and responsibility.
Technology can fail for many reasons, including infrastructure problems, configuration issues, software failures, and unexpected service demands.
Regardless of the cause, businesses still need to understand how those failures affect their operations.
If email becomes unavailable, how will employees communicate?
If a cloud service goes down, does the organization have an alternative way to continue essential operations?
Do IT and cybersecurity teams understand their responsibilities during a service disruption?
Does leadership know which business functions depend on a particular provider?
And most importantly, have employees been educated on what to do when the technology they rely on is no longer available?
These aren't questions reserved for large corporations.
Small businesses need to be having these conversations, too.
The answer isn't necessarily purchasing more tools or hiring more specialists.
Sometimes it begins with better education, clearer responsibilities, stronger communication, and a more complete understanding of the technology already in place.
Have We Created Too Much Separation Between IT and Cybersecurity?
I believe we have.
Somewhere along the way, we began treating IT support and cybersecurity as separate worlds rather than interconnected disciplines.
The problem isn't specialization. The problem is creating silos where knowledge isn't shared, responsibilities aren't clearly understood, and education focuses on one discipline without recognizing its relationship to the other.
Being able to fix a computer is a valuable skill.
Understanding how to secure that computer is another valuable skill.
But neither automatically makes someone an expert in every aspect of technology.
We need professionals who are confident in what they know, willing to acknowledge what they don't know, and committed to continually expanding their understanding.
We also need organizations that recognize cybersecurity isn't solely the responsibility of a security department, just as technology reliability isn't solely the responsibility of the help desk.
Both require collaboration, accountability, and support from leadership.
And both depend on education.
It's the Same Coin
Technology will continue to evolve, and the way we educate professionals, manage systems, and define responsibility must evolve with it.
We can't keep discussing cybersecurity without acknowledging the IT foundation it depends on.
And we can't keep discussing IT support without recognizing the security responsibilities that come with maintaining technology.
Technology is the coin. IT support is the foundation. Cybersecurity protects that foundation. And education helps us understand our responsibilities on both sides.
The Technology Responsibility Model isn't simply about deciding who fixes a problem or who prevents an attack.
It's about recognizing how responsibilities connect, from technology providers and IT professionals to cybersecurity specialists, business leaders, and everyday users.
Because ultimately, technology responsibility isn't just about keeping systems running or protecting them from threats.
It's about understanding how technology works, knowing the limits of our expertise, and recognizing how our decisions affect everyone who depends on it.
