I don't think you're going to see as many lawsuits are you think. Most of these contracts probably state that they had to follow reasonable precautions for business continuity and data recovery. Having Crowdstrike in the path seems to have been a reasonable and potentially best practice before today's outage.
I don't think that companies are going to be held liable at all.
Eh. I think you're underestimating how overmatched these IT depts are when it comes to cybersecurity.
Either sign a contract with a best-in-class (even if in name only) vendor who says that they'll do all of this for us or we need to become "experts" in cybersecurity and potentially still use them.
The CIO is overmatched here so they're making the decision that protects them and their clients in _almost all_ cases.
Once they are taken to court and all their crap gets subpoena'd I think we might find that reasonable precautions were not taken.
Its possible that this update was never properly QA'd and was just rushed out the door. If thats the case then it could be found to be negligence, and no amount of legal jargon protects you from negligence. It could be the end of CrowdStrike. /end fud.
I don't think that companies are going to be held liable at all.