CrowdStrike outage: Disruption may cost insurance market up to $1.5 billion

A cyber risk analytics company CyberCube has estimated that the July 19 Crowdstrik outage could cost the cyber insurance market between $400 million and $1.5 billion. This would be a 3-10 per cent hit on the global cyber insurance premiums, which are currently $15 billion.

If these estimates hold, the CrowdOut (Crowdstrike outage) event could be the largest insured loss in the history of cyber insurance over the past 20 years. However, it still doesn't match the worst-case scenarios that cyber insurers and reinsurers are preparing for. CyberCube's models suggest this event is between a 1-in-2 and a 1-in-6 year event. For perspective, the most extreme events they model could result in losses up to 234 per cent of premiums in a 1-in-200 year event.

Even though the estimated losses aren't as high as the worst-case scenarios, this event is still important for understanding and validating risk models. If this had been a malicious ransomware attack, the losses could have been much higher. The estimates are still preliminary because many systems are still being fixed. Each insurance company will experience different levels of loss depending on their specific policies and the companies they insure.

The time it takes to recover systems is crucial for business interruption coverage. These waiting periods usually range from 8 to 12 hours, but can be anywhere from 6 to 24 hours. Larger companies often take longer to recover because their IT systems are more complex. Since this event wasn't caused by a malicious attack, it will likely trigger system failure coverage, which isn't standard in many policies and is often limited.

Methodology of calculating the losses
CyberCube claims to specialise in measuring cyber risk. They've used knowledge of technology dependencies to estimate the losses from this event. This includes direct impacts on companies using CrowdStrike Falcon and Microsoft Operating Systems, and indirect impacts on companies relying on these systems, like payment processors and software service providers.