Microsoft Cloud Outage Highlights Cyber Insurance Challenges

A major IT outage caused by a security update from CrowdStrike disrupted companies worldwide today, affecting airlines, hospitals, financial services, and media sites. Analysts predict that business interruption claims will dominate the insurance losses, raising questions about the readiness of cyber insurers, notably Beazley, to handle such large-scale events.

Goldman Sachs analysts highlight the focus on potential business interruption claims, emphasizing the cause and duration of the outage. Despite CrowdStrike ruling out a cyber attack, the unprecedented scope of the incident underscores the risks of cyber accumulation and significant business interruptions.

RBC Capital Markets analysts expect business interruption to account for most insured losses. They note that since a software update, not a cyber attack, caused the disruption, the overall impact might be less severe. However, the outage could still qualify as a cyber catastrophe, providing a crucial test for the cyber insurance market’s resilience.

The cyber insurance market has grown recently but lacks a significant stress test to evaluate the carriers’ underwriting capabilities due to limited historical data and advanced modeling. Analysts at RBC question whether this event could be the litmus test for the market, especially for Beazley.

If the event is indeed a litmus test, it could validate Beazley’s cyber underwriting efficacy, assuming the insurer withstands the financial impact. Early indications suggest no capital risk for Beazley, but the final impact will become clearer over the coming weeks and months.

Goldman Sachs analysts also note that Beazley has measures to mitigate tail risk, such as an 8-hour breakdown provision in many contracts. This should help limit potential business interruption losses, assuming the outage was not a cyber attack and lasted less than 8 hours.