Your Competitor Has a Crisis. Is It Your Opportunity?

October 7, 2026 editorial edition; first added to the site October 19, 2026. The opening and secondary illustrations are AI-generated conceptual scenes.

A competitor's systems fail. Their customers are furious. Someone forwards the coverage to the sales team with a perfectly reasonable suggestion: this must be our moment.

Perhaps. But there is another email worth imagining, arriving from one of your own customers: could the same thing happen with you?

The first email sees an opening. The second sees a category. A useful competitive brief has to be ready for both.

On July 19, 2024, a CrowdStrike content configuration update caused a widespread outage on Windows systems running its affected sensor. The company's root-cause account describes the failure. Microsoft estimated that 8.5 million Windows devices were affected.

For another security vendor, the obvious question was whether customers would look for a replacement. The more difficult question was what they would now require any replacement to prove.

Those questions developed together. Within eight days, Microsoft was publicly discussing the architecture and safeguards used across the security ecosystem. A month later, SentinelOne reported increased interest in its alternative. By September, it was participating in a discussion about improving the shared system.

That sequence is more instructive than a winner-and-loser headline.

The buyer may redraw the category

A competitor's failure does not arrive with a label saying how widely to apply it. People make that judgment. They may see a poorly managed company, an unreliable product design, or a risk built into the way an entire industry operates.

Research by Michelle Roehm and Alice Tybout gives us a way to think about that movement. Their 2006 paper investigated when a scandal affects attitudes toward other brands. In the experiments described by Kellogg, participants read fictional scandals involving real companies. A hamburger-related scandal at Burger King affected attitudes toward traditional fast-food restaurants; the same category effect did not follow a hamburger-related scandal at Dairy Queen. How typical the brand was, and how central the attribute was to the category, mattered.

The implication for a rival is uncomfortable. The quality that made your offering easy to compare with the market leader can also make the leader's problem easy to associate with you.

This is the practical meaning of cross-brand contagion. The concern travels through a perceived similarity. A competitor can avoid the original failure and still inherit a question about the conditions that allowed it.

The question widened in eight days

On July 27, Microsoft published a technical explanation of the outage and security-tool practices. It explained why multiple security vendors, including Microsoft, use kernel drivers: code operating deep inside the system can provide visibility, performance, and protection against tampering. That access also makes reliability especially consequential.

The discussion went beyond identifying the faulty update. It covered reducing kernel code, validating updates, and managing deployment safely. Different vendors can implement different designs and controls; shared dependence does not make their risks identical.

For a competitor reading the environment that week, this was a change in the brief. The platform provider was explaining a class of risks and safeguards. A response built entirely around being a different logo would have been too small for the question already in public view.

This is where I would put the spillover research to work. Once the shared architecture enters the discussion, ask: which parts of the criticism could a buyer reasonably apply to us? The question gives the team something to investigate before its own brand becomes the subject.

That is an investigation the technical team can help answer while the communications team follows how the question spreads. Waiting for your own name to trend would lose the advantage of having understood the mechanism.

The same rival can compete and cooperate

SentinelOne's August 27 shareholder letter reported increased customer interest and large enterprises evaluating its platform. It emphasized its architecture and resilience in the aftermath of the outage.

That is a substantive commercial signal: management was describing evaluations, not merely attention. It is still management's account, rather than a verified count of customers won because of the incident. The quarter ended July 31, just twelve days after the outage. Assigning all of its growth to the event would be an enthusiastic use of a calendar.

Then consider the September 10 Windows security ecosystem summit, described by Microsoft two days later. The participants discussed staged updates, testing, recovery, and future security capabilities outside kernel mode. It was a discussion, not a meeting that enacted a completed solution.

SentinelOne's Ric Smith supported stronger engineering, testing, and deployment standards in the account, while saying his company already followed the relevant practices. The same rival was arguing for its difference and supporting work on the conditions all the vendors operated within.

I think the combination is the smarter competitive posture: explain the difference while helping strengthen the system the buyer still needs. A pure attack leaves the category question unanswered. A claim that everyone is alike throws away distinctions the buyer needs to examine. SentinelOne's two public responses addressed both levels.

The usual choice between attacking a rival and saying nothing misses this third kind of work.

A denial can introduce the association

There is a trap in reacting too quickly. The Roehm–Tybout research also tested denials. When spillover had occurred, a competitor's denial could help correct the inference. When it had not, the denial could make attitudes worse by introducing an association the audience had not made.

An unsolicited announcement that your company is different can therefore do two jobs: reassure people who already wondered, and give everyone else a reason to wonder.

The decision turns on whose concern you are answering. An existing customer's specific operational question deserves a specific answer. A public campaign aimed at an audience that has not connected you to the problem is a different intervention. It needs a reason beyond the competitor being in the news.

I would establish whether the audience has made the connection before choosing the message. The answer can justify a public explanation, a targeted customer conversation, or staying out of a discussion that does not yet involve you.

Anger is not a migration plan

The other mistake is treating every dissatisfied customer as a prospect ready to move.

A person trying to restore service may be furious with the supplier and unable to consider a replacement that afternoon. The next decision might belong to a procurement team weeks later. A change could require integration work, approvals, training, or a contract window. An angry post does not remove any of those constraints.

This is why the specific language in a commercial report matters. A complaint tells you what hurt. A request for a technical comparison tells you a choice may be reopening. A request for a migration plan brings implementation into the conversation. Each gives the next team something different to do.

SentinelOne's reported enterprise evaluations belong in that middle category. They justify investigating the opening. They do not let an analyst skip ahead to completed switches or revenue attributable to the outage.

A useful brief would connect the public concern to the questions the sales and customer teams are actually receiving. Which prospects have asked for evidence? Who owns the decision? What must an alternative demonstrate before an evaluation can proceed? That is how a weak signal becomes material.

The opportunity is to reduce the buyer's uncertainty

“We were unaffected” can be a useful opening fact. Compared with what, under which conditions? I would want the next sentence to explain how the company prevents or contains this class of failure. That answer needs controls, dependencies, and recovery a buyer can examine.

In the CrowdStrike aftermath, a credible alternative had to address both its own design and its place in the wider Windows environment. In another industry, the equivalent might be a shared manufacturer, a payment network, or a distribution partner. The relevant comparison follows the buyer's new concern.

That work also has a cost. If a sudden influx overwhelms onboarding or support, the business can reproduce the disappointment that created the opening. A campaign should not promise a transition the operating team cannot deliver.

The useful finding in this case was available well before a final tally of winners and losers: the market was discussing both alternative suppliers and stronger safeguards. A team watching only the rival's negative coverage would have seen half the decision.

The sales email and the existing customer's email belong on the same desk. One asks whether there is business to win. The other tells you what winning it may now require.