Insurers are expecting a wave of notifications in the coming days in the aftermath of the CrowdStrike-triggered outage, with losses likely to be seen under business interruption and contingent business interruption clauses, according to Acrisure Re.

Most cyber policies include triggers for malicious and non-malicious events, and BI and contingent BI coverage typically extends to incidents at IT vendors. Some cyber policies will also contemplate contingent BI coverage for non-IT vendors.

Tancred Lucy, vice-president of Acrisure London Wholesale, says insurers will have engaged their panel vendors to work with impacted companies to reduce insured downtime and extra expenses. “Insurers may be expecting bricking losses if the manual reboot required for individual endpoints is not universally successful or the resulting downtime incurs a larger business interruption loss than simply replacing a device,” he explained.

With CrowdStrike’s estimated 20% market share for cyber security amongst large companies (and 50% of Fortune 500 companies), most of the victims of the incident are household names, according to Lucy, with the event felt most acutely amongst large and mid-market corporates, but not restricted to them.

“When considering that over 20,000 companies use CrowdStrike Falcon in conjunction with Microsoft and many Managed Security Service Providers license Crowdstrike for their clients, it brings single point of failures and systemic exposures amongst SMEs into greater focus. The number of companies that rely on a business using CrowdStrike Falcon in conjunction with Microsoft, is estimated to be in the millions.

“Insurers will need to come up with a plan to manage and address these exposures, without withdrawing coverage that is clearly crucial to buyers. In the short term, insurers should hold the line until the full picture becomes clear.”

---