Australian businesses disrupted by Friday's global Microsoft 365 failure face a problem before they reach any question of quantum. Nothing was breached and most cyber policies need a breach to engage at all.
“Normally you need what's called an actual or suspected breach to get into the policy. I think most people impacted by this are unlikely to meet that threshold,” said Joe Hershewe, claims practice leader at Bellrock Advisory in Sydney.
The failure took Outlook, Teams, SharePoint and Copilot offline from early Friday in Australia. Microsoft has attributed it to a process on the affected servers that became overloaded and news reports have said it was rolling back a network change that coincided with the start of the problem.
Read next: Microsoft outage puts Australian cyber policy wordings to the test
Jennifer Clancy (pictured), advisor for cyber risk at Bellrock Advisory, said the event itself had been anticipated for some time. “I think we've been almost waiting for something like this to happen,” she said. “I think cyber insurance has been talking about these events that have just been on the horizon for a very long time.”
No Bellrock client has reported an actual compromise, as far as Hershewe was aware. Had one done so, he said, the response would have been immediate: notification to the cyber incident hotline and the start of triage. Without that, the question is not how much a policy pays but whether it answers at all.
How far a cyber wording extends to systems the insured does not control is already contested. Insurance Business examined the point in August 2026 in a piece on why clients buying cyber insurance may still not be covered.
Insureds who cannot clear the breach threshold would have to rely on an endorsed or extended form of cover that does exist in the market, Hershewe said, though it carries its own qualifying criteria for what counts as a widespread event.
“That's not standard in most mid-market cyber wordings,” he said. He said this option generally sits with sophisticated purchasers buying standalone policies with some select cyber insurers.
Clancy said those criteria would have to be satisfied before any such endorsement helped, and that cannot happen while the cause remains unresolved. “Even for this to meet what qualifies as a widespread event endorsed and to meet those criteria, that would need to be established too, because obviously we don't even know what's caused this,” she said.
She said the design of the class is the underlying issue. “Not many of them are equipped to deal with an event like this,” she said. Cyber policies are built around first-party and third-party cover responding to the financial losses from data breaches, hacking events, ransomware and privacy incidents.
Read next: Banks warn of outage scams as Microsoft narrows in on fault
Clancy said the response so far had been mixed. “I think people are more in the space of trying to get their own services back up online and running and seeing what's urgent and what's not,” she said. “I don't think people have maybe quite turned their attention yet to cyber insurance and how the policy responds for them and what cover they have in place.”
Hershewe put the delay down to the way the event presented, as an outage of services. “I do think people are slow to think about insurance,” he said. Insurance Business has separately reported warnings to Australian employers over the Friday 13th Microsoft outage.
Hershewe said the cause remains open, and could be a threat actor, a server failure or human error. If it does prove to be an attack, he said, it would be a risk already talked about rather than a new one.
“The thing that surprises me is always the timing because you just never know when it's going to hit,” he said.
He said any large IT company with that many users of its software and services becomes a target. “Microsoft, or any major cloud or technology provider, is a massive target,” he said. “Because you knock them down and then you impact scores and scores of people.” Insurance Business has covered that concentration in its reporting on cloud concentration risk in the Microsoft 365 outage.
Clancy expects more of the same. “We are going to keep seeing this, I think, especially with how interconnected everything is,” she said.
