When the Safety Net Meets a Shared Shock
Cyber insurance is a contract for transferring and recovering from certain losses caused by digital incidents. The question this series examines is narrower and more consequential than whether a company has bought such a policy: what happens to that safety net when many companies depend on the same software, cloud platform, or critical service? Understanding that question helps a reader distinguish an ordinary insured loss from a correlated event that can strain several insurers, leave coverage disputed, and still damage the wider economy after the policy has paid.
The difficulty begins with a change in the object being insured. A company may buy a policy for its own systems, but its ability to operate depends on systems beyond its boundary. Its payments may pass through a financial intermediary. Its data may sit with a cloud provider. Its production line may rely on common software, a managed service, or a supplier whose own suppliers are invisible to the company. The company is a legal entity with a policy; the risk is a network.
The risk is no longer confined to the victim’s network
“Cyber risk” is often used as shorthand for malicious hacking. The broader insurance and supervisory view is more useful. A cyber incident can result from a technical malfunction, human error, an insider, or an external attack. Ransomware, phishing and data theft are important examples, but a faulty software update or a failure at a digital service provider can also interrupt operations at thousands of organisations. The cause matters for investigation and coverage, yet the economic effect may be similar: systems stop, data become unavailable, customers cannot be served, and recovery costs begin to accumulate.
Digitalisation increases the value of these connections and therefore increases the consequences when one fails. EIOPA’s December 2025 Financial Stability Report describes cyber risk as having moved from an IT-specific concern to a macro-financial stability concern. That is not a claim that every breach destabilises markets. It is a claim about the route by which a sufficiently disruptive event could travel. The report identifies interconnectedness, loss of confidence and lack of substitutability as transmission channels.
Interconnectedness is the easiest channel to see. In November 2023, an attack on ICBC, a primary dealer in US Treasury markets, prevented the firm from clearing trades and was associated with higher volatility and reduced liquidity in those markets, according to EIOPA’s cited account. The example is not important because one institution is always systemically vital. It is important because a failure in one organisation can interrupt a function on which other participants rely.
Technology creates a second layer of connection that crosses sector and national boundaries. A vulnerability in a widely used product does not respect the map of insurance jurisdictions. A cloud provider can serve banks, hospitals, manufacturers and retailers at the same time. A single point of failure is not necessarily a single physical machine; it can be a common service, software component, or dependency that many organisations cannot quickly replace.
Non-malicious incidents make the point without an attacker. EIOPA cites the faulty CrowdStrike software update of July 2024 as a global disruption affecting millions of devices. The BIS Financial Stability Institute report similarly treats technical failures and human error as part of the cyber-risk landscape. For an insurer, the absence of hostile intent does not automatically remove the business-interruption loss. It may change the policy response, but it does not make the downtime, restoration work, or liability exposure imaginary.
The resulting mental model is simple but important: digital dependence can convert a local event into a shared shock.
This is why geographic diversification, which is useful for many traditional risks, can be less reassuring here. Two policyholders in different countries may still share the same cloud region, software library, identity service, or managed provider. Their claims may be legally separate while their cause is common. The insurer sees several customers; the digital system may have experienced one failure.
What the corporate safety net is meant to do
Cyber insurance matters because the financial effects of an incident can outlast the technical event. A firm may need forensic investigation, legal advice, customer notification and crisis communication before it can resume normal operations. It may lose income while systems are restored. It may need to replace data or software. If customers, regulators, or business partners are harmed, it may face third-party claims. A policy can help fund these responses, and the insurer’s associated services can sometimes shorten recovery as well as reimburse cost.
The product is therefore better understood as a package of possible protections than as a single promise. First-party cover addresses the insured firm’s own costs, such as incident response, business interruption, cyber extortion and data restoration. Third-party cover addresses liabilities to others, including network-security or privacy claims and, where the law permits, regulatory defence or fines. Policies may be standalone or added to another commercial policy. The exact triggers, limits, retentions and exclusions differ across contracts and jurisdictions.
That last sentence is not a technical footnote. It is part of the stability question. A company can have a cyber policy and still have a large uninsured or disputed exposure. Contingent business interruption, for example, concerns a supplier or service provider whose cyber incident prevents the insured from operating. Fraud or social-engineering losses may fall under a crime policy, a cyber policy, both, or neither, depending on the facts and wording. A power outage may be excluded unless it was directly caused by a cyber incident affecting the insured’s system. The label on the policy cannot answer these questions by itself.
There is also exposure in policies that were not sold as cyber insurance. “Silent cyber” describes cover that neither clearly includes nor clearly excludes cyber loss. A property or liability policy can then respond to a cyber-originated claim even though the insurer did not deliberately price that exposure within a cyber portfolio. The 2017 NotPetya attack is the report’s defining example: around 85% of insured losses were reported through property claims that did not explicitly include or exclude cyber attacks.
Silent exposure matters for two reasons. First, it creates uncertainty for the policyholder at the moment of claim. Second, it can hide accumulation from the insurer and supervisor. If the same event can produce claims under a standalone cyber policy, a property policy, a liability policy and a crime policy, counting only the dedicated cyber book understates the possible aggregate loss. Clear affirmation or exclusion can reduce that ambiguity, but wording remains jurisdiction-specific, and the BIS report notes that some exclusion language has not yet been tested in court.
Insurance also has a preventive function. Underwriting may require evidence of multifactor authentication, patch management, backups, segmentation, incident response capability, or oversight of key suppliers. Premiums and deductibles can signal that stronger controls change the risk. Post-breach services can be particularly valuable to smaller organisations that lack specialist staff. These functions make cyber insurance more than a cheque written after failure.
But insurance does not make the system safe by itself. If a company treats the policy as permission to postpone patching, test recovery less often, or accept an opaque dependency map, the underlying probability and severity of loss may rise. An insurer can reduce the financial shock retained by the firm without reducing the shared vulnerability that caused the shock. In that case, the policy is a recovery layer, not a substitute for resilience.
Why a small market can carry a large question
The scale of the current market can obscure the scale of the problem. EIOPA reports that, at the end of 2024, cyber underwriting in the European Economic Area represented less than 1% of total non-life business by both premiums and technical provisions. EEA earned cyber premiums were about EUR 6 billion, of which direct business accounted for EUR 3.6 billion; inward reinsurance represented 40%. Almost 80% of the coverage was standalone, and corporate clients accounted for most of it. Premiums declined by about 2% in 2024 after a period in which new capacity and competition pushed prices down.
Those figures support a careful conclusion. Cyber insurance did not yet dominate European insurers’ balance sheets, so its direct current effect on sector-wide stability was limited. They do not support the conclusion that the business line can be ignored. The line is growing, its risks are difficult to model, much of the economy depends on the same digital infrastructure, and cyber losses can appear outside the dedicated cyber book. A small set of policies can also matter if it covers firms that provide critical services or if a shared event reaches several lines at once.
The BIS report places the global cyber-insurance market at USD 15.3 billion in gross written premiums in 2024, twice its 2020 size, while noting that it remains less than 1% of global property-and-casualty premiums. Against that, estimates of total economic losses from cyber incidents range widely, from roughly USD 1 trillion to above USD 10 trillion annually. The range is a reminder that market size and economic exposure are not measured on the same basis. It is more reliable to use the comparison as an order-of-magnitude warning than as a precise loss ratio.
This mismatch also explains why the phrase “safety net” needs qualification. A safety net does not have to catch every fall to be useful, but it must catch the falls it promises to catch, and it must not fail because the net’s threads are connected to one another. Cyber insurance can help a company pay for response, resume operations, share liability and improve its controls. It can support resilience beyond the financial sector. Yet if the loss comes from a shared vulnerability, the insurer may face many claims at once; if the wording is unclear, the claims may spill into unrelated policies; if the event is too large or too difficult to measure, private capacity may be insufficient.
The central tension is therefore not between insurance and cybersecurity. It is between the logic of diversification and the structure of digital dependence. Insurance works best when a pool contains risks that do not all produce losses at the same time. Cyber systems often do the opposite: they make organisations more efficient by sharing infrastructure, data, software and services. That sharing can lower operating costs while increasing the correlation of failures.
A credible assessment of cyber insurance must keep both sides in view. Asking only whether a firm bought cover misses the limits, exclusions and dependencies. Asking only whether a catastrophic event is possible misses the real recovery value of a policy for ordinary incidents. The useful questions are more specific: What loss is being transferred? Which dependency could affect other policyholders? How much of the loss is retained, capped, excluded or reinsured? What controls reduce the chance or duration of disruption? Who bears the remaining tail if many firms are hit together?
Those questions lead to the practical judgement this series will develop. Cyber insurance can be a valuable corporate safety net, but its reliability depends on conditions outside the policy document: firms must strengthen their resilience, insurers must understand shared exposures, contracts must say clearly what is covered, and supervisors and governments must address risks that private markets cannot diversify. The next step is to examine the policy itself—what it covers, what it leaves open, and why those boundaries become more important when one incident can become many claims.