CrowdStrike: Why did insurers slow down?

Following the CrowdStrike security review disaster, many thousands of claims for internet policies, business interruption (BI), travel cancellation and event cancellation coverage are still being accounted for. The largest IT blackout in history cost an estimated US$5.4 billion in damages.

However, reports suggest that insurance firms are almost certainly not working.

Estimates of insured losses range between US$300 million and US$1 billion. Global insurance broker Guy Carpenter reported that less than 1% of cyber insurance companies worldwide were affected.

One reason: compared to a cyberattack, this disruption in a non-violent environment has limited the overall impact.

Another important thing for insurers, according to experts, is the quick dispatch of repairs. This allowed many organizations to address the issue before the typical four to 12 hour wait time for BI requests expired.

What courses are available for insurance brokers?

However, one surprising feature remained: the end seemed to blindside many Internet security and IT professionals. What lessons should the insurance industry take from this event?

London-based Rory Egan (large image, above), is head of cyber analytics for Aon's Reinsurance Solutions. He described the disruption as “the most significant event to hit the cyber insurance market, since NotPetya in 2017.”

However, he provided an unquestionably convincing estimate of the losses from the CrowdStrike event.

“At the moment the potential loss may be between 5% and 15% of the total amount paid through the Internet for the year,” said Egan. “That's interesting as it roughly matches the annual 'catastrophe load' set aside by cyber insurers to cover cyber and IT events, called 'Cyber ​​​​​​​​CATs'.”

Fast response and time

He attributed the small loss to the quick response from both CrowdStrike and IT teams around the world.

“The timing of the event was also a factor as the impact was most felt in time zones such as Australia which was not sleeping due to the initial outage caused by the faulty update,” Egan said.

In Australia, Matthew Koce (pictured below) is CEO of the Members Health Fund Alliance, the peak body for private health insurance companies.

“The main concern is with consumers and making sure private health insurance claims can still be processed,” Melbourne-based Koce said.

He said health insurers were able to contain any impacts within a few hours and without causing major disruption to customers – despite the attack occurring during the working day.

“On Friday evening everything was resolved,” said Koce. “We certainly don't hear complaints from consumers.”

Did government regulations help?

One of the reasons Australian insurers avoided major losses, he suggested, was local government regulations.

“Being APRA [Australian Prudential Regulation Authority] in a regulated industry, all health insurance funds have detailed risk strategies and there is a lot of IT scrutiny up to independent audits and inspections,” said Koce. “The risk of a cyber breach or IT shutdown is one of the things that keeps many health funders and regulators up at night.”

Egan said the event emphasizes how cyber and IT risks come in many forms, including malicious attacks and IT outages – and can come from leading cyber security companies.

“'It can happen to anyone', and the widespread impact highlights the interdependence of software ecosystems,” he said.

No technology is 100% guaranteed.

Koce said the CrowdStrike incident is a reminder that no matter how large or complex a third-party provider is, technical efficiency cannot be taken for granted and 100% guaranteed.

“Organizations must have robust risk management processes and mechanisms in place to prepare for worst-case scenarios,” he said.

Koce said important lessons for all businesses include the importance of backing up resale plans and processes and transparent communication with stakeholders during a crisis.

“Thankfully, CrowdStrike kept the lines of communication open throughout the incident and worked quickly and professionally to resolve the issue,” he said.

Are some internet policies too restrictive?

In a blog, Joshua Motta, CEO of Coalition Insurance Solutions (Coalition), a global cyber insurance provider, suggested that the incident will raise awareness of the current limitations of many cyber policies.

For example, online BI policies are only available after 12 hours.

He said this event is also a warning about the dangers of the economy.

“Fifteen companies worldwide account for 62% of the market for cybersecurity products and services,” Motta said. “The failure of this event shows the real tension in public policy that exists between the benefits of economies of scale and the risks associated with concentration.”

What do you see as lessons from CrowdStrike? Please tell us below