There's a question that doesn't get asked nearly enough in mainstream economic conversations. And honestly, it should be keeping more people up at night.
What happens if Apple goes dark? Not a bad earnings quarter — gone. What if Amazon's infrastructure collapsed tomorrow, or Google's advertising ecosystem simply... stopped?
For most people, that sounds like a thought experiment. A fun hypothetical for a college economics seminar. But here's the uncomfortable truth: we're living inside an experiment that's already running. And we may not fully understand the exposure until something actually breaks.
The Evolution from Tech Companies to Essential Infrastructure
Think about what these companies actually are today versus what they were twenty years ago.
Apple launched as a computer company. Google was a search engine. Amazon sold books. That origin story feels almost quaint now because the reality of what each company has become is fundamentally different — and far more consequential.
Apple's market capitalization has, at various points, exceeded the GDP of countries like Australia, Spain, and the Netherlands. Alphabet — Google's parent company — controls roughly 90% of global search traffic and dominates the digital advertising ecosystem that millions of small businesses depend on to find customers. Amazon Web Services doesn't just power e-commerce. It powers a significant portion of the internet itself, including government agencies, hospital systems, and financial institutions.
These aren't just large companies. They're infrastructure. And that distinction matters enormously when we start talking about systemic risk.
What "Too Big to Fail" Actually Means
To understand why this matters, it helps to revisit where the phrase came from.
"Too big to fail" entered the public vocabulary during the 2008 financial crisis. When institutions like Bear Stearns and Lehman Brothers collapsed, the cascading effects rippled through the entire global economy. Banks were so deeply interconnected — their balance sheets so intertwined — that letting one fail meant threatening all of them. The government intervened because the alternative was worse.
The core logic was simple: when a single entity's failure threatens the broader system, that entity has achieved systemic importance. Its health becomes everyone's problem.
Now apply that logic to Big Tech. The interdependencies are different in form but eerily similar in function. Millions of businesses run their operations on Amazon Web Services. A disruption there doesn't just hurt Amazon — it shuts down the businesses that pay AWS bills, the customers those businesses serve, and the workers who depend on those businesses for income. The cascade is real and it's already happened on a small scale. When AWS experienced regional outages in 2017 and 2021, major portions of the internet went offline. Smart home devices stopped working. News sites went dark. Airlines had trouble processing reservations.
Those were minor disruptions. Now imagine something far more severe.
Infrastructure Dependency and the Cloud Concentration Problem
Here's where the systemic risk conversation gets particularly uncomfortable.
The cloud computing market is dominated by three players: Amazon Web Services, Microsoft Azure, and Google Cloud. Together, they control roughly 65% of global cloud infrastructure. This concentration means that an unprecedented portion of the world's digital activity — banking transactions, healthcare records, government communications, e-commerce, media distribution — flows through a handful of privately operated systems with no mandatory stress-testing, no capital reserve requirements, and no government backstop equivalent to what financial institutions carry.
Banks, post-2008, face annual stress tests mandated by the Federal Reserve. Regulators simulate catastrophic scenarios — severe recessions, market crashes, geopolitical shocks — and banks must demonstrate their ability to survive. There's nothing remotely equivalent for cloud infrastructure providers. No framework exists to simulate "what if AWS goes down for 72 hours?" at a regulatory level.
That's not a criticism of Amazon specifically. It's a structural gap in how regulators think about systemic risk in the 21st century.
Data as a Risk Vector — A New Kind of Vulnerability
Beyond infrastructure dependency, there's another dimension of systemic risk that rarely gets the attention it deserves: data concentration.
Apple holds biometric data for hundreds of millions of users. Google processes over 8.5 billion searches per day, building detailed behavioral profiles in the process. Amazon tracks purchasing behavior, supply chain movements, and consumer preferences across its retail and logistics operations. The aggregation of this data in private hands creates a vulnerability profile unlike anything regulators designed their frameworks to handle.
A catastrophic data breach at any of these companies wouldn't just damage the company's reputation. It would compromise the personal and financial security of potentially billions of individuals simultaneously. It would expose supply chain intelligence that competitors and adversarial governments could exploit. It would destabilize trust in digital commerce at a foundational level.
Financial institutions face rigorous cybersecurity requirements and mandatory breach reporting timelines precisely because regulators recognized this risk. The equivalent framework for Big Tech remains fragmented, jurisdictionally inconsistent, and frankly insufficient for the scale of exposure involved.
The 2008 Parallel — Where It Holds and Where It Breaks Down
The comparison to 2008 is instructive but imperfect. And it's worth being honest about both.
The parallels are real. Pre-crisis banks operated with significant opacity — their risk exposure was poorly understood by outsiders and, often, by themselves. Big Tech companies similarly operate in ways that outsiders struggle to fully audit. The interconnectedness that made banks dangerous in 2008 mirrors the ecosystem interdependencies that make Big Tech dangerous today. And in both cases, the implicit assumption of institutional permanence distorts market behavior.
But the divergences matter too. Banks failed because of leverage and liquidity — they borrowed too much and couldn't cover their positions when asset values collapsed. Big Tech's risk profile is different in character. These companies don't face the same liquidity fragility. Their risks are more operational, competitive, and structural. A Big Tech "failure" might look less like a sudden Lehman-style collapse and more like a gradual erosion of trust, a regulatory fracture, or a technological disruption that undermines a core business model.
The moral hazard dimension, though, translates almost perfectly. When markets perceive an institution as too systemically important to be allowed to fail, investors price that implicit guarantee into valuations. The company benefits from lower risk premiums and preferential access to capital. This creates a feedback loop: systemic importance generates market advantages that reinforce systemic importance. It's the same dynamic that inflated pre-crisis bank balance sheets. And you can see traces of it in how index funds — which must hold these stocks by design — continuously recycle capital into these companies regardless of underlying risk.
Regulatory Responses — Well-Intentioned but Structurally Mismatched
To be fair, regulators haven't been entirely asleep. The European Union's Digital Markets Act represents one of the most ambitious attempts to impose structural constraints on Big Tech's market dominance. The U.S. Department of Justice has pursued antitrust actions against Google's search monopoly and Apple's App Store practices. The Federal Trade Commission has scrutinized Amazon's acquisition strategy.
But here's the structural problem: these frameworks were designed to address market competition concerns — price-fixing, monopolistic behavior, consumer harm through reduced competition. They weren't designed to address systemic risk in the sense that financial regulators think about it. Antitrust and systemic risk are related but distinct problems.
Breaking up Google's search business doesn't necessarily reduce the systemic vulnerability of cloud infrastructure concentration. Forcing Apple to allow third-party app stores doesn't address the data aggregation risks that come from controlling a primary commerce and communications platform for over a billion users. The regulatory tools available are mismatched with the risks they're being asked to address.
What's missing is a framework specifically designed around systemic technology risk — something analogous to how the Financial Stability Oversight Council (FSOC) designates systemically important financial institutions and subjects them to heightened oversight. A "Systemically Important Technology Institution" designation, with corresponding resilience requirements, stress-testing mandates, and operational continuity obligations, would at least acknowledge the problem in structural terms.
The Broader Stakes — Markets, Consumers, and Democratic Governance
The economic consequences of inadequate oversight here aren't abstract. They hit ordinary people where it hurts.
Passive investing has become the dominant vehicle for retirement savings in the United States. Index funds and target-date funds that anchor most 401(k) portfolios are structurally obligated to maintain heavy exposure to the largest companies in the index. Apple, Microsoft, Amazon, and Alphabet together represent an enormous share of the S&P 500's total weight. When retirees and working-class savers put money into index funds, they're involuntarily concentrating systemic risk in their own portfolios — without necessarily understanding or consenting to that exposure.
Small businesses dependent on platform ecosystems face an even starker vulnerability. A merchant whose entire customer acquisition strategy runs through Google Ads, whose logistics depend on Amazon's fulfillment network, and whose payment processing runs through infrastructure hosted on AWS is exposed to systemic dependencies they have virtually no power to diversify away from. That's a structural fragility that regulators haven't adequately addressed.
And then there's the dimension that goes beyond economics entirely. These companies don't just move money and products. They shape information flows, moderate public discourse, and increasingly interact with democratic processes through advertising platforms and content distribution. A systemic failure — or a systemic misuse — of these platforms carries consequences that don't fit neatly into any existing regulatory category.
What Comes Next — Preemptive Action or Crisis-Driven Adaptation?
History offers a discouraging but honest pattern here.
Financial regulators didn't build adequate systemic risk frameworks for banks until after 2008. The warning signs existed well before the crisis. Academic economists, central bank researchers, and financial journalists identified the concentration of risk in overleveraged institutions years before it exploded. The political will to act preemptively simply wasn't there.
The question facing policymakers, investors, and business leaders today is whether they'll repeat that pattern with Big Tech — waiting for a crisis to force the regulatory adaptation that clear-eyed analysis already demands.
The systemic importance of Apple, Google, and Amazon isn't a future risk. It's a present reality. The infrastructure dependency is already built. The data concentration already exists. The market interdependencies already shape the global economy. What doesn't yet exist is a regulatory framework proportionate to that reality.
And if history is any guide, we probably won't build one until we absolutely have to. The hope is that "too big to fail" stays a question we're debating in blog posts — and doesn't become a phrase we're using to explain the next economic crisis.