System failure cover (non-malicious)

The first cyber policies paid business interruption only in case of attack: intrusion, malware, denial of service. Yet a large share of IT outages is not malicious at all. An administrator deletes the wrong database, a migration fails, a vendor update disables thousands of workstations. System failure cover extends protection to these unintentional outages. It comes in two levels: failure of the insured's own systems, and dependent failure, that of the providers it relies on, host, online software vendor, payment provider. The second level is what underwriters fear most, because a single failure at a large provider hits thousands of insureds at once. The July 2024 incident, in which a faulty update to a security product crashed some 8.5 million Windows computers worldwide, showed its scale: no attack, yet massive business interruption in aviation, healthcare and banking. Policies therefore frame this cover tightly: a waiting period of several hours, a sublimit, exclusion of essential infrastructure failures, sometimes a named list of covered providers. It is one of the boundaries where cyber insurance meets traditional property insurance.