.svg){kind=icon}
Why CrowdStrike Insurance Claims Are Under Scrutiny
Companies are still reeling from CrowdStrike’s errant software patch last week that caused millions of Windows systems to crash. Thankfully most affected organizations are back online as attention turns to mitigating the costs of extended downtime.
Many teams will try to lean on their cybersecurity liability insurance to cover claims and costs from this incident. There's surface-level logic. CrowdsStrike is a cybersecurity company, so one could make the argument that any claims resulting from their mistakes are in effect cybersecurity claims. There’s an important wrinkle in this story, though, that underscores why businesses need a comprehensive suite of insurance coverage instead of relying on a single policy.
Understanding Cyber Liability Limits
Plenty of technology SMEs should consider cyber liability business insurance but fewer know its coverage limits and definitions. Cyber liability coverage is most applicable when companies face an external cyberattack (e.g. a denial of service or DoS attack) or when external parties access secured customer data. These attacks are common and underscore the need for tech companies to adopt robust security postures and achieve standardized certifications like SOC 2 Type I.
The challenge is that CrowdStrike has said this incident was not the result of a cyber attack, but rather a software update that contained a bug. In practice this means that businesses insurers are likely to deny a large swatch of cybersecurity claims stemming from CrowdStrike’s update because no cybersecurity breach took place. Instead, companies with errors & omissions and especially business interruption insurance will see the most benefit from covered claims.
Beating Business Interruption
Business interruption insurance – policies which are more agnostic to the cause of damages than cyber liability – will provide the most coverage for the CrowdStrike affected. Below are a few commonly covered scenarios (a non-exhaustive list):
- Natural Disasters: Events like hurricanes, earthquakes, floods, and tornadoes can cause physical damage to business premises, leading to closures and interruptions in operations.
- Utility Outages: Business interruption policies often cover losses resulting from utility outages, such as prolonged power failures or disruptions in water supply.
- Equipment Breakdown: Coverage can include interruptions caused by the breakdown of critical machinery or equipment essential to business operations.
- Government-Mandated Closures: Situations where government actions require businesses to close, such as for public health or safety reasons, may be covered depending on policy specifics.
- Supply Chain Disruptions: Some policies cover losses due to disruptions in the supply chain that prevent the business from continuing normal operations.
While obviously not a natural disaster, many teams will receive claims benefits from interruption insurance with clauses for utility outages, equipment breakdown, or supply chain disruptions.
Mitigating Future Outages
If the CrowdStrike debacle tells us anything, it’s that companies need the right suite of coverage policies as opposed to the right single policy. General liability and even cyber liability policies will come up short in scenarios like this one where the incident was caused by error rather than third-party attack.
Koop’s customer assurance platform helps tech companies seamlessly navigate the complexities of business insurance, regulatory compliance, and security automation in one place.
We provide a comprehensive suite of insurance coverage that includes General Liability, Technology Errors & Omissions, Cyber Liability, and Management Liability coupled with the most cost-effective SOC 2 compliance certification on the market.
Ready to learn more? Visit our website at https://www.koop.ai or drop us a note at hello@koop.ai.
