Licensed Agency · NPN #22222940Prefer to talk? Call our team at +1 (689) 353-8505
Most small businesses no longer run their own software. Scheduling, billing, electronic health records, point of sale, payroll and email live with outside providers, and when one of them goes down, the business stops with it. Whether a cyber policy pays for that downtime depends less on how big the outage was than on a handful of definitions most owners have never read.
Two events from 2024 show the range. On July 19, 2024, the security company CrowdStrike released a defective software update that crashed Windows computers around the world. Microsoft estimated that about 8.5 million Windows devices were affected, less than 1 percent of all Windows machines. Airlines, hospitals, banks and 911 services were among the organizations disrupted, and many businesses that never used CrowdStrike felt it through vendors that did.
Earlier that year, a ransomware attack on Change Healthcare disrupted thousands of hospitals, pharmacies and medical practices that relied on its services. The civil rights office of the U.S. Department of Health and Human Services opened investigations, citing the attack's unprecedented impact on patient care and privacy.
From an insurance standpoint, those were different kinds of events. One was an accident with no attacker involved; the other was a criminal attack on a vendor. Many cyber policies treat those two situations very differently.
Cyber business interruption coverage pays lost income, plus extra expenses such as overtime and added IT help, when the policyholder's own computer systems are partly or completely interrupted. That part of the policy is generally limited to failures of the insured's own systems, not systems someone else hosts.
Dependent business interruption, also called contingent business interruption, is the part that responds when a third party's systems fail. Many policies extend it to outages at cloud and software-as-a-service providers, and some go further to cover other service providers. Whether a policy includes it at all, and for which providers, varies widely. Some cyber specialists warn that coverage bought as an endorsement to a businessowners policy often lacks it entirely.
Much of the recovery turns on what caused the outage. Policies usually describe two kinds of triggers:
A policy may cover dependent business interruption caused by a security failure at a vendor but not one caused by a system failure, or it may cover both. After the CrowdStrike outage, Moody's Ratings expected businesses to claim under "systems failure" provisions because the event was not a malicious attack, and described that coverage as becoming standard. Becoming standard is not the same as universal, so your own policy's wording is what counts.
Read the definitions as well as the headings. Some policies define system failure narrowly, and some limit which providers qualify. A provider outage that fits neither definition can leave a business with no dependent coverage at all.
Business interruption coverage in cyber policies usually carries a waiting period, a number of hours the interruption must last before coverage applies. After the CrowdStrike outage, one cyber insurer described the typical waiting period as eight hours. Policies treat the waiting period differently once it is met: with many insurers, only the loss after the waiting period counts, while at least one insurer treats it as a trigger and then covers the loss from the start of the outage.
For a short outage, the waiting period can decide everything. A practice that loses its scheduling system for five hours under an eight-hour waiting period has no business interruption claim, however chaotic the morning was. Dependent coverage may also carry its own waiting period, separate from the one for the insured's own systems.
Dependent business interruption may carry a lower sublimit than the main business interruption limit. In its analysis of the CrowdStrike event, one cyber insurer reported that some carriers were adding catastrophic or widespread-loss sublimits and exclusions, and others were adding dependent business interruption sublimits or exclusionary language. The concern behind those changes is aggregation: one provider failing for thousands of policyholders at the same moment.
Look for any exclusion aimed at widespread events or at failures of outside infrastructure, and for sublimits that apply only to vendor outages. Check whether the policy pays extra expense as well as lost income, since overtime and temporary workarounds can cost more than the revenue lost.
Medical and dental practices show why this matters. Electronic health records, claims clearinghouses, imaging systems and patient portals usually belong to outside vendors, and an outage stops appointments while payroll keeps running. When the vendor event is also a data breach, a practice can have notification duties of its own under HIPAA and Florida law even though the attack happened elsewhere, so breach response coverage matters alongside business interruption. The cyber insurance page for Florida medical practices covers those duties in more detail.
Keep a simple log of vendor outages with start and end times and the revenue affected. That record makes a claim easier to prove and shows which providers deserve a closer look at contract time.
Did cyber insurance cover the CrowdStrike outage?
It depended on each policy. A business whose policy covered system failures, including those at third-party providers, and whose downtime outlasted the waiting period had a path to recovery. Policies limited to security failures, or without dependent coverage, were far less likely to respond to an outage with no attacker behind it.
Is dependent business interruption the same as business interruption?
No. Business interruption covers an outage of your own systems, while dependent business interruption covers income lost because a provider's systems went down. A policy can include one without the other, so confirm both are listed.
Can my vendor contract replace insurance?
Rarely in full. Vendor contracts often limit what the provider will pay, and recovering money from a vendor takes time even when the contract allows it. Insurance responds on its own terms, and the insurer may later pursue the vendor for what it paid.
What is a typical waiting period?
Eight hours is common, though policies vary. In some policies the waiting period only marks when coverage begins, while in others the first hours of loss are also left out of the claim, which changes how much a short outage pays.
List the three or four outside systems your business cannot run without, then check your cyber policy's dependent business interruption wording against each one: the trigger, the waiting period and the sublimit. A Truscott coverage review can compare how different cyber markets handle vendor outages and show where a policy covers attacks but not accidents. Learn more on our cyber insurance page, including options for businesses statewide on the Florida cyber insurance page.
How the regulatory section of a cyber policy pays to defend a regulator's inquiry after a breach, and which fines may be insurable where the law allows.
Cyber InsuranceHow AI voice cloning pushes fraudulent payments, which parts of a cyber or crime policy might respond, and the verification steps insurers expect.