Can Cyber Insurance Still Be a Safety Net?

Cyber insurance can still be a safety net, but only conditionally. It becomes unreliable when a shared digital shock creates more correlated loss than policies, models, capital and public arrangements can define or absorb. This final synthesis brings those conditions together so a reader can answer the opening question, judge what insurance is genuinely useful for, and recognise when relying on it alone would be unsafe.

The answer is not that cyber insurance is failing in every case. A policy can fund incident response, restore data, replace lost income, defend liability claims and help a firm recover after an incident. Underwriting can encourage stronger controls, while insurers’ response services can add expertise that smaller firms do not have. The answer is also not that a large limit solves systemic risk. A limit on one policy does not reduce a shared vulnerability, and a payment from one insurer does not prove that the market can withstand the same event across thousands of policyholders.

The decisive question is whether the loss remains sufficiently measurable, bounded and diversifiable for the insurance arrangement that promises to bear it. When it does, cyber insurance can complement resilience. When it does not, the contract may narrow, claims may move into silent or overlapping policies, reinsurance may concentrate the same exposure, and a public backstop may be asked to fill a gap that was never clearly designed for it.

The failure is a chain, not a single exclusion

Imagine a widely used cloud or software service that supports identity, data, payments or a critical business process. An attacker exploits a vulnerability, or a faulty update makes the service unavailable. The service is upstream, but its customers are spread across industries and countries. Some firms lose access to their own applications. Others can operate internally but cannot serve customers because the shared service is down. A third group faces data or liability consequences. An industrial customer may suffer physical damage when a connected process stops.

At the policy level, these are separate losses. One firm may claim incident response and business interruption under affirmative cyber cover. Another may need contingent business-interruption protection for a supplier outage. A third may seek privacy or network-security liability cover. A fourth may test a property or cyber-physical policy. Fraud may raise a question under a crime policy. If the wording is silent about cyber, claims may appear in a line that was not deliberately priced for that exposure.

At the system level, the losses have one cause. The event can therefore create claims at the same time, across several policies, insurers and jurisdictions. A portfolio that looks diversified by country or industry may be concentrated by software, provider or infrastructure. The central failure is not that one contract contains one unfortunate exclusion. It is that the entire chain—from dependency to claim to capital—can be coupled by a common event.

Five failure surfaces compound each other.

First, the dependency can be hidden. A firm may know its direct vendors but not the software components or subcontractors beneath them. An insurer may receive a technology questionnaire without a complete map of the policyholder’s exposure to common providers. The same service can appear as a small detail in many separate underwriting files while being a major concentration at portfolio level. Geographic diversification offers limited protection when firms in different countries use the same platform.

Second, the policy boundary can be unclear. Silent cyber exists when coverage is neither explicitly included nor explicitly excluded. A cyber-originated loss can then reach property, liability, professional-indemnity or crime policies without the insurer having intentionally captured it within cyber limits. The NotPetya experience, in which the BIS report says around 85% of insured losses were reported through property claims that did not explicitly include or exclude cyber, illustrates the issue. That share is a reported feature of that event, not a general rule. Its importance is the exposure path it reveals.

Third, claims can arrive together while looking different. A shared event does not produce identical invoices. One firm pays to restore data; another loses income; another faces customer claims; another suffers physical damage. Different loss types can trigger different policy sections or lines. The variation may make accumulation harder to recognise even as the underlying cause is common. It can also prolong the claims process because legal, regulatory and contractual questions develop at different speeds.

Fourth, the loss distribution can change faster than the model. Historical data are incomplete and often delayed. Attackers, software, controls and business dependencies change. A past claims record may not show how a future vulnerability affects a newly centralised service.