Microsoft Dependency Has Risks

Hello, author here. The main point is that it's not a financially rational decision to ditch Microsoft.

There's just no real alternative for businesses, as most use AD, Teams, Outlook/Exchange and couple others.

I don't think expected value is the right way to evaluate this. All insurance is negative expected value (that's how insurance companies make a profit), but businesses find it rational to buy insurance.

Also I'd say your risk of getting cut off is much more than 1 in 2 million, because there's nothing to say this can only be done to one company at a time. What if Trump adds e.g. a whole country to the sanction list, and tells Microsoft to cut that country off?

That's the trick behind ROSI. You weight the expected cost without mitigation against the mitigated cost plus the cost of your solution.

The risk of getting cut off is the most random variable on the list. I agree with your point, but I have no data to back it up with.

> That's the trick behind ROSI. You weight the expected cost without mitigation against the mitigated cost plus the cost of your solution.

Right but that's clearly not the right way to think about it; if you did that you'd never buy insurance (and probably never do any security work tbh, since very little of it can be justified in expected value terms). The impact of catastrophic damage is nonlinear.

Yes, at the end of the article I come to the conclusion that this method has flaws. But the general insurance can be modelled with ROSI.

Say you have a 300k USD car. Say that a crash will cost you the full cost. You expect one crash in five years. You then have a yearly expected cost of 60k. If you get an insurance that pays for it all, for 10k USD a year, your ROSI is 500% which sounds like this insurance product is great for you.

> Say you have a 300k USD car. Say that a crash will cost you the full cost. You expect one crash in five years. You then have a yearly expected cost of 60k. If you get an insurance that pays for it all, for 10k USD a year, your ROSI is 500% which sounds like this insurance product is great for you.

But in the real world those numbers are backwards - otherwise insurance companies would go bankrupt! Your insurance for that will cost, like, 70k/year, your ROSI will be 80%, and you'll still buy the insurance, and you'll be right to do so.

Of course it was an oversimplified example. All I wanted to show that ROSI can make a compelling argument for buying insurance. Now you're arguing that insurance is too cheap.