Building Infrastructure That Bends Without Breaking: A Primer On Resilience

IT experts explain how midmarket IT leaders can build resilient infrastructure with dependency mapping, observability, graceful degradation, and identity-first recovery

If the past few years have taught IT leaders anything, it is that even a well-built IT estate can buckle under steady disruption. Nowhere is that clearer than in the midmarket, where small teams run systems spread across cloud regions and a layer of SaaS and AI services they do not fully control.

The cost of a bad day has climbed with that complexity. Uptime Institute found that most outages now cost more than $100,000, and one in five exceeds $1M, enough to wipe out a quarter's worth of earnings for many midmarket companies.

Given how unpredictable IT outages can be, preventing every disruption is no longer the goal–some failure is now a given. The focus has shifted to limiting how far a failure can spread and how quickly the business can recover.

MES Computing spoke with several IT experts on what it takes to build modern, resilient infrastructure in the midmarket environment.

Strategic Framework for Resilience in Midmarket IT

One vital takeaway is that no single tool or strategy delivers resilience.

Start with Dependency Mapping

The most common resilience gaps are found in unmapped third-party SaaS integrations or unsecured data pipelines that feed into shadow AI tools, said Stanislav Kazanov, head of GRC, cybersecurity and sustainability at Innowise.

He argues that many companies migrate workloads to the public cloud with the assumption that their cloud provider will manage availability and ignore the reality that interconnected APIs can create systemic vulnerabilities throughout their business. He cited the case of a midmarket logistics firm that recently experienced an operational shutdown, not due to a failure of their core database but due to an unmonitored API that connected their inventory to an external courier service going down.

“As more and more companies use automated tools, organizations must establish strict inventory controls. Without this, even a small outage at a secondary vendor can create a ripple effect of failures in the company’s internal network,” Kazanov said.

Apply Graceful Degradation

A hallmark of resilient infrastructure is the ability of its core services to adapt and function in a degraded manner even when chaos strikes. And the choice of these services has to be settled in advance and prioritized based on revenue and customer impact, says Pavan Madduri, senior Cloud Platform Engineer at W.W. Grainger, Inc. He further suggests that orgs should tier their services by blast radius ahead of time, so revenue-generating and customer-facing functions come back first while the fallback for everything else is already wired through the service mesh.

For midmarket firms that depend on frontier AI models to power some core business applications, Madduri suggests it’s best to route applications to a cached state or a smaller local model so that when a frontier model goes offline, the whole application won’t crash.

Visibility Before Redundancy

While a dependency map shows what the business relies on, it might not reveal when one of those dependencies is failing in real time. Noe Ramos, VP of AI Operations at Agiloft, calls this “ silent failure” — where an AI agent, for instance, keeps returning subtly wrong output with no error to flag it. Catching that takes monitoring at the layer where the work runs, which is why Ramos said he would spend the first dollar on visibility before duplicating hardware.

"Before you buy more redundancy, make sure you can actually see what you have," Ramos says, noting that the firms hurt worst are usually the ones that never knew anything was wrong until it became a crisis.

Ramos is not alone on this. A recent SolarWinds report examining how AI is reshaping modern observability found that 77 percent of IT pros acknowledged serious visibility gaps across cloud and on-premises systems. The report identified those gaps as the biggest obstacle to managing increasingly fragmented hybrid environments

Recovery Starts with Identity

Technology alone cannot guarantee a successful recovery. Organizations also need to practice the recovery process itself, particularly when identity systems have been compromised. Mona Rajhans, Senior Software Engineering Manager at Palo Alto Networks, argues that identity should be the first priority during recovery because compromised credentials can undermine every subsequent restoration effort.

“You cannot easily recover from an attacker who has been living in your environment for six months as a legitimate user,” Rajhans says.

Kazanov shares a similar view on preparation, recommending that organizations regularly rehearse worst-case scenarios by conducting unannounced drills to rebuild Active Directory from bare metal. Since ransomware operators frequently target backups and credentials first, teams need confidence that they can restore critical identity infrastructure under pressure.

One Key Investment for Resilience

For midmarket CIOs looking to invest in the capabilities that will strengthen infrastructure resilience, Madduri recommends investing in programmable policy-as-code, admission controllers, and runtime guardrails, rather than another backup platform or additional disk space. His reason? Configuration drift and its consequences have been the quiet destroyer of resilience in cloud-native architectures.

“Just one misconfigured, throttling-disabled, over-permissioned container running in your cluster is capable of causing far more trouble than it actually should. If you enforce programmable guardrails at the deployment level, the mistakes people make can no longer reach production,” he said.