Common-mode failure is when a single shared weakness, dependency, or design flaw causes multiple systems to fail at the same time. Instead of one isolated component breaking, many services collapse together because they rely on the same software, cloud provider, identity service, model vendor, network control, or operational process.
In cyber security, this matters because attackers often look for shared points of trust. A vulnerability in a common library, misconfigured authentication layer, poisoned data pipeline, or compromised third-party platform can impact many organizations at once. Defenders worry about it when they standardize too much or place critical functions on the same control plane without enough segmentation. Reducing common-mode failure risk means diversifying dependencies where practical, isolating critical systems, testing recovery paths, and assuming that one vendor or one control may not be enough to protect the whole environment.