Pandemic-Style Cyber Events: What Insurance Scenarios Say

Insurers use the word "systemic" for a cyber event that hits many customers through one shared dependency. Chubb makes the pandemic comparison directly: a cyber catastrophe, "Like a pandemic," has "no geographic boundaries or temporal limitations." This post looks at what published scenarios and estimates say, and what a buyer can do with that.

These are modelled scenarios, not forecasts. None of them says an event is likely in any year.

What the sources say

Lloyd's, January 2018. With the modeller AIR Worldwide, Lloyd's published a scenario in which a leading US cloud provider is knocked offline for 3 to 6 days. The central estimate was $15 billion of economic loss, up to $3 billion of it insured, with a 95 percent range of $11 billion to $19 billion. AIR's Scott Stransky said "there's still a significant gap in cyber coverage." Manufacturing carried the largest loss, at $8.6 billion.

Lloyd's, August 2022. Market Bulletin Y5381, dated 17 August 2022, required state backed cyber attack exclusions in standalone cyber policies from 31 March 2023. Its own explanation is useful: the ability of attackers to spread code, together with society's dependence on IT, "means that losses have the potential to greatly exceed what the insurance market is able to absorb."

CrowdStrike outage, 19 July 2024. This was a faulty software update, not an attack, so many cyber policies responded only in part. Published estimates varied with scope. Parametrix put direct losses for Fortune 500 companies, excluding Microsoft, at about $5.4 billion. For insured losses, Guy Carpenter estimated $300 million to $1 billion, calling it "a sizable but manageable insured loss." CyberCube estimated $400 million to $1.5 billion for standalone cyber policies, which it put between a 1 in 2 and 1 in 6 year event, and said that range was about 3 to 10 percent of roughly $15 billion in global cyber premium. Its own model shows far worse outcomes at 1 in 200 years, with a loss ratio of 234 percent. Guy Carpenter estimated fewer than 1 percent of insured companies were affected.

Business Blackout, 2015. A Lloyd's and Cambridge Centre for Risk Studies scenario of an attack on the US power grid is reported to give $243 billion in economic loss in the base case and over $1 trillion in the extreme case. We could not open the full report, and Lloyd's describes the scenario as an exploration, not a prediction.

Federal Reserve, May 2026. The Financial Stability Report notes that non malicious events such as software malfunctions have also disrupted financial services, and that shocks can spread through shared providers.

The pandemic comparison, and where it stops

The shared feature is correlated loss: many policyholders claim at once, from one cause, without regard to geography. That is why insurers watch aggregation more than any single claim.

The comparison has limits. Pandemics have a long record of observed events. Systemic cyber events have a short one, so models rest on few data points and on assumptions. The 2024 outage landed well below the 1 in 200 scenario CyberCube models, which suggests real events and tail scenarios can differ a lot in size.

What it means for a policyholder

• A claim is only as good as its wording. Read the war and state backed exclusion and the definition of infrastructure failure.
• Check whether dependent business interruption covers an outage at a supplier, a cloud provider or a software vendor, and at what sub limit.
• Check waiting periods. A short outage may fall below one.
• Do not assume insurance replaces resilience. The estimates above show losses far above insured amounts.

What to do now

1. List your shared dependencies: cloud region, identity provider, endpoint software, payment processor.
2. Ask your broker where each one sits in your policy, and in writing.
3. Estimate what a 3 day and a 10 day outage of your top dependency would cost you.
4. Decide what you will keep running manually, and rehearse it once.
5. Keep an SBOM so you can quickly answer which of your products use an affected component. The free scan at https://gold.safeguard.sh/scan runs in the browser, needs no login and handles up to 100 dependencies.

Quick check

Sources

• Lloyd's press release: failure of a top cloud service provider could cost the US economy $15 billion, 23 January 2018
• Lloyd's Market Bulletin Y5381, 17 August 2022
• Artemis: CyberCube estimates insured losses from CrowdStrike event at $400m to $1.5bn, 25 July 2024
• Fortune: CrowdStrike outage and Fortune 500 losses, 3 August 2024
• Chubb: A better way to define and insure systemic cyber events
• SecurityWeek: Cyber attack on power grid could top $1 trillion, report
• Federal Reserve, Financial Stability Report, May 2026