Does cyber insurance cover income lost when a vendor or cloud provider goes down?
Sometimes. A property policy’s contingent business income needs physical damage, so a software or cloud outage at a vendor does not trigger it. Some cyber policies add dependent business interruption, which pays income lost when a provider you rely on has an outage, after a waiting period. Whether yours does depends on whether the trigger includes system failure as well as attacks, how long the waiting period is, and the sublimit.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
Why the property policy does not answer
Contingent business income on a property policy pays when another business’s property is physically damaged. A cloud provider’s software update that locks up your point of sale damages nothing. The outage is real, the lost sales are real, and the trigger is missing.
That leaves cyber insurance as the place this loss can be insured, and cyber forms vary more than property forms do. There is no standard ISO wording to rely on.
Security failure versus system failure
Some cyber policies pay lost income only when a hacker or malware causes the interruption, called a security failure. Others also pay when systems go down without an attack, called a system failure. That difference decides whether an accidental vendor outage is covered. The July 2024 CrowdStrike outage was not an attack, so brokers framed the question around whether a policy had system failure cover.
A second choice sits on top: whether the policy covers only your own systems or also those run by providers you rely on. That extension is dependent business interruption.
The waiting period and the limit
Cyber business interruption usually starts after a waiting period counted in hours. One law firm’s review of the CrowdStrike claims put it at typically 8 to 24 hours. An outage your provider fixes in four hours may fall entirely inside the waiting period and produce no claim.
Limits matter as much. Parametrix expected cyber policies to cover no more than 10 to 20 percent of the Fortune 500 loss, citing large retentions and low limits. Those are large companies, but the pattern applies to smaller ones: a limit sized for a small incident does not match a multi-day outage.
What to ask about your own policy
Ask whether the policy has dependent business interruption, whether it names providers or covers them generally, whether system failure counts as a trigger, how long the waiting period is, and what the sublimit is in dollars. Then compare the answers with how long you could trade without your point of sale, booking system or online store.
The detail
Contingent and dependent business income on a property policy needs direct physical loss at the other business; a software or cloud failure does not meet that test.
Adjusters International, Adjusting Today: Contingent Dependent Properties Insurance
The July 19, 2024 CrowdStrike outage was non-malicious, and broker analysis placed it under the system failure heading of cyber policies.
Parametrix estimated direct financial loss of $5.4 billion for the US Fortune 500 excluding Microsoft and insured loss of $540 million to $1.08 billion; this is an estimate, not a count of claims paid.
Parametrix, CrowdStrike to cost Fortune 500 $5.4 billion (24 July 2024)
Parametrix expected cyber insurance to cover no more than 10 to 20 percent of that loss, because of large retentions and low policy limits.
Parametrix, CrowdStrike to cost Fortune 500 $5.4 billion (24 July 2024)
Cyber business interruption coverage may not begin until a waiting period has passed, which one law firm describes as typically 8 to 24 hours.
Whether a cyber policy responds to a partner or supplier outage turns on its language, including whether the trigger is a security failure or also a system failure.
A broker analysis said coverage for the CrowdStrike outage would depend on the waiting period in the cyber policy and on the trigger negotiated into the wording.
CRC Group, Potential insurance impacts of the CrowdStrike outage (July 2024)
What this means for you
- List the digital providers you cannot operate without. Payments, hosting, booking, e-commerce platform, phone system. Those are the outages to test the policy against.
- Check the trigger word. Ask whether it says security failure only, or system failure too, and whether providers’ systems count.
- Know your waiting period. If a typical outage ends before it, the coverage never pays.
- Do not buy a property endorsement expecting it to cover this. It needs physical damage. A cloud outage has none.
Related questions
- Is dependent business interruption the same as contingent business interruption?
The terms are used interchangeably. On a cyber policy, dependent business interruption means lost income caused by an outage at a provider you rely on, instead of at your own systems.
- Would the CrowdStrike outage have been covered?
It depended on the policy. Brokers said the answer turned on whether the policy covered system failure, whether it extended to outside providers, and whether the outage outlasted the waiting period. Estimates of insured loss were published, but we did not find a reliable total of claims paid.
- Does regular contingent business income cover a cloud outage?
No. Property dependent properties coverage needs physical damage at the other business.
- Contingent business income, explained
- Is this the same as first-party cyber coverage?
It is a part of it. First-party cyber pays your own costs, including lost income, and dependent business interruption extends the lost-income piece to outages at others.
- First-party against third-party cyber insurance
Need this handled?
Reading about it and having it handled are different jobs, and the second one is ours. We place the accounts other brokers decline — claims history, a cancellation, an unusual operation, a business nobody wants to underwrite twice — and we will tell you when the policy you already have is the right one. Tell us the situation and a licensed human replies the same business day.
Written by Kevin Kelsey, founder and principal agent, CA License #6011822, at Boring Insurance. Last updated 2026-10-25. See all guides.