CrowdStrike: Why did insurers get off quite lightly?

Following the CrowdStrike security update disaster, many thousands of claims on cyber policies, business interruption (BI), travel and event cancellation coverages are still being tallied. The largest IT outage in history cost an estimated US$5.4 billion in damages.

However, reports suggest insurance firms are probably off the hook.

Estimates of insured losses range between US$300 million and US$1 billion. Global reinsurance broker Guy Carpenter has reported that less than 1% of companies with cyber insurance globally were affected.

One reason: compared to a cyberattack, this outage’s non-malicious nature limited overall impact.

Also important for insurers, according to experts, the speedy deployment of a fix. This allowed many organisations to deal with the issue before the typical four-to 12-hour waiting period for BI claims expired.

What are the lessons for insurers?

However, one striking feature remains: the outage appeared to blindside many cyber and IT security experts. What lessons should the insurance industry take home from this event?

London-based Rory Egan (main picture, above), is head of cyber analytics for Aon’s Reinsurance Solutions. He described the disruption as “the most important widespread event for the cyber insurance market, since NotPetya in 2017.”

However, he offered an arguably reassuring estimate of losses from the CrowdStrike event.

“At this stage the loss potential might be between 5% and 15% of total annual cyber premiums,” said Egan. “That is interesting as it roughly aligns with the annual ‘catastrophe load’ set aside by cyber insurers to cover widespread cyber and IT events, so called ‘Cyber CATs’.”

Rapid response and timing

He attributed the relatively low losses to the rapid response from both CrowdStrike and IT teams around the world.

“The timing of the event was also a factor as the impact was felt more acutely in time zones such as Australia who were not sleeping through the initial outage caused by the defective update,” said Egan.

In Australia, Matthew Koce (pictured below) is CEO of Members Health Fund Alliance, the peak body for the country’s private health insurers.

“Of immediate concern was consumers and making sure private health insurance claims could still be processed,” said Melbourne-based Koce.

He said health insurers were able to contain any impacts within hours and without causing significant disruptions to customers – despite the attack happening during a working day.

“By Friday evening everything was pretty much resolved,” said Koce. “We are certainly not hearing any complaints from consumers.”

Did government regulations help?

One reason Australian insurers avoided significant losses, he suggested, was local government regulations.

“Being an APRA [Australian Prudential Regulation Authority] regulated industry, all health insurance funds have detailed risk strategies in place and there is a lot of scrutiny around IT that even extends to independent audits and assessments,” said Koce. “The risk of a cyber breach or an IT shutdown is one of the things that keeps most health funds and regulators awake at night.”

Egan said the event underlines how cyber and IT risks come in many forms, including malicious attacks and IT outages – and can even originate from leading cyber security companies.

“‘It can happen to anyone’, and the widespread impact highlights the interdependent nature of software ecosystems,” he said.

No tech is 100% guaranteed

Koce said the CrowdStrike incident is a reminder that however large or sophisticated a third-party provider is, the smooth operation of technology cannot be taken for granted and 100% guaranteed.

“Organisations need to have robust risk management processes and practices in place that prepares them for worst case scenarios,” he said.

Koce said key lessons for all businesses include the importance of back-up redundancy systems and processes and also transparent communication with stakeholders during a crisis.

“To its credit, CrowdStrike did keep the lines of communication open throughout the incident and worked quickly and professionally to resolve the issue,” he said.

Are some cyber policies too limited?

In a blog, Joshua Motta, CEO of Coalition Insurance Solutions (Coalition), a global cyber insurance provider, suggested the incident will raise awareness around the current limitations on many cyber policies.

For example, BI policies linked to cyber coverages that only kick in after 12 hours.

He said the event also serves as a warning of the dangers of economies of scale.

“A mere fifteen companies worldwide account for 62% of the market for cybersecurity products and services,” said Motta. “The fallout from this event illustrates the very real public policy tension that exists between the benefits of economies of scale and the risks associated with concentration.”

What do you see as the lessons from the CrowdStrike outage? Please tell us below