Business interruption
Cover for the loss of margin and additional costs suffered by a business whose operations are interrupted.
On July 19, 2024, a faulty CrowdStrike update knocked out about 8.5 million Windows machines. One market estimate put direct losses for the Fortune 500 at 5.4 billion dollars, and none of the victims had been attacked. Business interruption cover pays for the financial consequences of a company's operations stopping or slowing after a covered loss, rather than for the physical damage itself. It typically covers lost gross margin, meaning lost revenue net of saved variable costs, plus the extra expenses incurred to limit the interruption, over an indemnity period set in the policy. In cyber insurance it has become the central cover, often costlier than the technical remediation itself, since an attack that paralyzes systems can halt production or invoicing for several days or weeks. It raises difficulties specific to cyber. That means setting the start and length of the interruption and separating the incident's share from pre-existing degradation. It also means handling interruption caused not by the insured but by the failure of a digital supplier, known as contingent business interruption. This last variant is one of the main sources of accumulation for cyber insurers.
Textbook case: a ransomware attack paralyzes a distributor's supply chain for ten days; business interruption cover indemnifies the margin lost on unrealized sales and the cost of processing orders manually as a fallback.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.