That would mean that you always need a fully redundant copy of everything based on entirely different OSes and software with no common component. That is obviously not realistic.

No. You just need to not update them all at the same time.

Unfortunately, CrowdStrike decides when it's time to upgrade CrowdStrike software, not the admins.

1. Your IT department shouldn't buy a product that let a third party change files on your system remotely. This one is the basis of computer security.

2. Your IT department shouldn't buy a product that doesn't give you control on when updates are applied.

These are 2 huge security failures from your IT department.

Automatic security updates are widely touted as the gold standard in IT security, at least for anything that is not a life-support system.

I am talking about control, I am not talking about disabling automatisation of updates.

You can have automatic security updates with delay between non prod and prod environments so that you can detect failures or possibly intrusions.

My understanding is that customers believed they had control as Crowdstrike gave them configuration options to delay updates / stagger them. Apparently many of them were surprised that Crowdstrike had the ability to bypass all these configuration options and force the update. I think that is where Crowdstrike's liability skyrockets through the roof.

Building high-assurance systems is expensive. Anyone not doing so must accept the associated risks (which is fine, not everything needs to be high-assurance).

What if the uptime of 50% of your computers does, but you need 100% percent of your computers to run at 100% capacity? If a shop has two lathes and one crashes, and now the shop has 50% capacity, is not losing money because of CrowdStrike's incompetence?