The widespread service disruption experienced by Revolut on October 20, 2026, highlights a fundamental challenge facing modern financial institutions: protecting customer information and financial assets is only one part of cybersecurity. Ensuring that customers can access their money and essential banking services is equally important.

Revolut, which serves more than 80 million customers across over 160 countries and regions, experienced a major outage affecting numerous digital banking services.

According to reports, 28 services were affected, including customer sign-ins, card payments, fund transfers, ATM withdrawals, currency exchange, stock trading, merchant payments and business APIs.

The company assured customers that their funds and personal information remained secure.

However, the disruption left customers unable to reliably access several essential financial services.

Subsequent reporting linked the incident to a Google Cloud infrastructure outage affecting its London region, which also disrupted services at other financial institutions and businesses.

This distinction is important. The reported outage was an infrastructure availability incident, not a confirmed cyberattack or data breach.

Nevertheless, it exposes several critical weaknesses that organisations must consider when designing secure and resilient digital infrastructure.

1. Cybersecurity is incomplete without availability

Cybersecurity has traditionally focused heavily on preventing unauthorised access, malware infections, ransomware and data theft.

However, the confidentiality, integrity and availability of information and systems are equally important foundations of information security.

A banking platform may successfully protect customer credentials, prevent unauthorised transactions and maintain the integrity of account balances.

But if customers cannot log in, make payments or access their funds, the organisation is still experiencing a serious failure in service availability.

For financial institutions, availability is not simply an operational performance metric. It is an essential component of customer trust.

A secure banking platform must not only protect money from being stolen. It must also ensure that legitimate customers can access their money when they need it.

2. Cloud adoption does not automatically guarantee resilience

Modern financial institutions increasingly depend on cloud infrastructure for scalability, flexibility and rapid deployment.

However, cloud adoption also introduces dependencies on external infrastructure providers, networking services, regional availability and shared technology components.

The reported Google Cloud disruption demonstrates how problems within a cloud provider's infrastructure can affect multiple organisations simultaneously.

Even when individual applications are securely designed, they may remain vulnerable to failures in the infrastructure supporting them.

Organisations must therefore evaluate whether their cloud architecture contains single points of failure.

Multi-zone deployment, regional redundancy, independent recovery capabilities and carefully designed failover mechanisms can reduce the impact of infrastructure disruptions.

However, simply deploying applications across multiple availability zones may not provide sufficient protection against a regional failure or a shared dependency.

Cloud infrastructure can improve resilience, but resilience must be deliberately designed, implemented and tested.

3. Shared dependencies can create systemic risk

One of the most concerning aspects of this incident is that the disruption extended beyond a single financial institution.

When multiple banks and digital service providers depend on the same underlying infrastructure, a failure within that infrastructure can affect numerous otherwise independent organisations.

This creates concentration risk.

An organisation may have strong internal security controls, redundant application servers and well-defined incident response procedures, yet still experience significant disruption because of a shared external dependency.

Financial institutions must therefore identify critical third-party dependencies and understand the consequences of their failure.

This includes cloud providers, DNS services, authentication platforms, payment gateways, network connectivity and external APIs.

The resilience of an organisation is increasingly determined not only by its own infrastructure, but also by the resilience of the external services on which it depends.

4. Application and API availability must be treated as business-critical

Modern digital banking platforms are built around interconnected applications and APIs.

Customer authentication, transaction processing, account information, merchant payments and mobile banking functions frequently depend on multiple backend services.

When a critical dependency becomes unavailable, failures can propagate across these interconnected components.

For example, the failure of a shared authentication service can prevent customers from accessing multiple applications even when the underlying transaction systems remain operational.

Similarly, failures involving API gateways, databases or cloud networking components can affect several business functions simultaneously.

Organisations should design applications to tolerate partial failures wherever possible.

This includes implementing appropriate timeouts, circuit breakers, request throttling, retry controls, service isolation and graceful degradation.

Application security and availability must therefore be considered together.

5. Web Application and API Protection contributes to resilience, but cannot replace infrastructure redundancy

Web Application and API Protection (WAAP) solutions play an important role in protecting digital services against malicious requests, exploitation attempts, automated abuse and application-layer denial-of-service attacks.

These capabilities can help preserve application availability when disruption is caused by malicious traffic or application-level threats.

However, WAAP cannot independently prevent outages caused by cloud infrastructure failures, power disruptions or unavailable backend dependencies.

A comprehensive resilience strategy must combine application security with infrastructure redundancy, disaster recovery, operational monitoring and business continuity planning.

Security controls should reduce the likelihood of malicious disruption, while resilient infrastructure should reduce the impact of failures that security controls cannot prevent.

6. Business continuity must be tested under realistic failure conditions

Many organisations maintain disaster recovery plans and backup infrastructure.

However, the existence of a recovery plan does not necessarily mean that critical services can be restored within acceptable timeframes.

Organisations must regularly test scenarios involving:

  • Complete loss of a cloud availability zone or region.
  • Failure of authentication and identity services.
  • Unavailability of payment processing or transaction APIs.
  • Loss of network connectivity or critical DNS services.
  • Failure of shared databases and application dependencies.
  • Simultaneous disruption of multiple business services.
  • Recovery while preserving transaction integrity and preventing duplicate financial operations.

For banking applications, recovery must also ensure that transactions are not lost, duplicated or incorrectly processed during failover.

Recovery Time Objectives and Recovery Point Objectives should reflect the business impact of service disruption rather than merely the technical convenience of restoring systems.

7. Monitoring must identify both malicious activity and operational failures

Security monitoring systems often focus on intrusion attempts, suspicious traffic, malware and unauthorised access.

Operational monitoring systems, meanwhile, focus on service health, infrastructure performance and application availability.

These capabilities are frequently managed independently.

However, major incidents can produce similar symptoms regardless of whether their underlying cause is malicious or operational.

A sudden increase in failed API requests could result from an application-layer attack, infrastructure failure, backend service disruption or configuration error.

Correlating network security events, application telemetry, infrastructure health and service availability can help organisations distinguish between these possibilities.

This can improve incident classification, reduce unnecessary investigation and support faster recovery decisions.

Effective security operations must understand not only whether an application is under attack, but also whether it is functioning correctly and why it may be failing.

8. Customer trust depends on both security and reliability

For digital-first financial institutions, customer confidence depends on the ability to access services consistently.

Customers may appreciate assurances that their money and personal information remain safe.

However, those assurances do not eliminate the immediate consequences of being unable to make payments, withdraw cash or transfer funds.

This is particularly important for customers who depend primarily on digital banking and have limited alternative payment arrangements.

Transparent incident communication, reliable status information and well-defined service recovery processes are therefore essential components of operational resilience.

Organisations should communicate clearly about affected services, expected recovery processes and available alternatives without making unsupported assurances about restoration times.

What should organisations learn from the Revolut outage?

At GajShield, we believe cybersecurity and operational resilience must be treated as complementary responsibilities.

Network security, intelligent intrusion prevention, contextual Data Loss Prevention, DNS intelligence and application security help protect digital infrastructure against different classes of threats.

However, these protections must be supported by resilient application architectures, reliable infrastructure, continuous monitoring and tested disaster recovery mechanisms.

A firewall can help prevent unauthorised network access.

An Intrusion Prevention System can identify and block certain malicious activities.

A WAAP solution can help protect applications and APIs against exploitation and malicious traffic.

Data Loss Prevention can help safeguard sensitive information against unauthorised disclosure.

But none of these controls, individually or collectively, can guarantee uninterrupted operations when critical infrastructure dependencies fail.

The objective must therefore be broader than preventing cyberattacks.

Organisations must build systems capable of detecting problems, containing failures, maintaining essential functions and recovering safely when disruptions occur.

The Revolut outage delivers an important lesson for the entire financial services industry:

A system can be secure against unauthorised access and still be unavailable to legitimate users.

Customer funds can remain protected while customers are unable to conduct essential transactions.

And an organisation can invest heavily in cybersecurity while remaining exposed to infrastructure dependencies outside its direct control.

True digital resilience requires three things: protecting information, maintaining service availability and ensuring the ability to recover when something fails.

The future of cybersecurity is not simply about keeping attackers out.

It is about keeping essential digital services secure, accessible and resilient, even when the infrastructure supporting them experiences unexpected failures.

Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. [...]

Source: Revolut outage disrupts online banking operations worldwide via Bleeping Computer — published 20 Oct 2026.