The Fragility of the Cloud: Eggs, Baskets, and the Broken Promise of the Internet

About seven years ago, I started talking - perhaps too insistently - about a latent risk in the digital economy: hyperconcentration. I warned that we were putting too many eggs in too few baskets. The market premise was seductive: agility, cost reduction, and operational simplicity that companies - and users - embraced without reservation. But this efficiency came with a hidden cost that's now coming back to haunt us: the systemic risk of availability.

To the average user, the players behind their screen are invisible until they're not. "Who is Cloudflare and why is it affecting my bank account?" millions of people wondered last week, during the global collapse on November 18 and 19, 2025. And just as we were recovering from that blow, we experienced déjà vu on our home turf: Mexico's major internet providers suffered massive outages, leaving millions disconnected not due to a lack of local infrastructure, but because of a critical dependence on services hosted outside our borders.

It's not about blaming others' success. On the contrary, it's commendable that companies like Cloudflare, Amazon Web Services (AWS), The AI Pods, or Google Cloud have built such efficient technological empires. However, we must admit that we've strayed from the internet's foundational promise: being a decentralized "network of networks," resilient to nuclear attacks, designed so that if one node falls, the system survives.

Today, that network is a commercial hierarchy. The world's most important companies, including those listed on the BMV or S&P 500, often have a CDN like Cloudflare (which manages nearly 20% of global web traffic) as their "entry point" and one of the three major hyperscalers as their "brain." If we look at the numbers at the close of Q3 2025, the concentration is alarming: AWS (30%), Microsoft Azure (20%), and Google Cloud (13%) collectively control 63% of the global cloud infrastructure.

Let's do a financial thought experiment. In the United States, there are over 4,000 FDIC-insured banks. That sounds like a diverse and robust system. But if we analyze where their data physically resides, diversity evaporates. The vast majority of these banks "live" in the data centers of these three giants, concentrated in specific regions like Northern Virginia (us-east-1). If we reduce the denominator to the few hundred availability zones these providers have in the United States, the vulnerability of the North American financial system - and by extension, the global one - is extremely high. A failure in Virginia is a heart attack on Wall Street.

Mexico isn't in a better position. Our banking, healthcare, and industrial systems suffer from a "double penalty." Typically, Mexican companies opt to host their services in the United States due to latency and cost. And although we celebrate the arrival of "cloud regions" in Querétaro - with multimillion-dollar investments from Amazon, Microsoft, and Google promising data sovereignty - the technical reality is more stubborn.

Although data may "live" in the Bajío, control services (like identity management or billing) often remain anchored in the United States. Moreover, our banking system may be regulatorily shielded by the CNBV, but it's still technically exposed to exogenous factors: from the failure of a Tier-1 carrier on the Laredo border (as likely happened on November 25) to a defective software update.

Because we're not just talking about "hardware" and data centers. The software world is equally fragile. The CrowdStrike incident in July 2024 taught us that you don't need a missile or a fiber cut to stop the world; a programming error in a homogenized security system is enough to shut down entire airports and paralyze operating rooms. The pursuit of "industry standards" created a digital monoculture where a single virus (or a bad update) can kill the entire crop.

I'm not trying to demonize these corporations; they fulfill their mission of generating value and do it excellently. But those of us in this industry need to change our "chip." We need to stop prioritizing immediate economic convenience. Resilience comes at a cost, but collapse costs more. We need to decentralize our decisions: from choosing internet providers to software architecture.

Finally, there's a pending task for the State. Digital sovereignty isn't decreed; it's built. Governments have the responsibility to promote public policies that mitigate this concentration. In Mexico's case, it's urgent to incentivize the creation and strengthening of our own IXP (Internet Exchange Points). We need direct connectivity to Asia, South America, and Europe, routes that don't have to pass through the "bottleneck" of Texas.

The internet promised freedom and redundancy. Today, it offers efficiency and fragility. It's up to us, executives and lawmakers, to decide if we'll continue putting all our eggs in the same digital basket, hoping that this time, the delivery person won't trip.