Some modern warehouses save floor space by packing aisles tightly together, using automated systems to move them apart so forklifts can reach the stock. When a cyber incident takes that technology down, stock can be left stranded.
Sam Cheshire (pictured), head of cyber (UK retail) at Gallagher, said failures at delivery firms and storage warehouses are the most common non-IT supplier losses he sees across his book, particularly in the Midlands. Clients have been left unable to deliver stock because a supplier few would ever have considered a technology risk suffered an incident.
Whether the client can claim then comes down to the wording. Many cyber insurers respond to failures at technology service providers, but not by default to suppliers that do not provide technology services to the client.
"Because they're not technically supplying our client with a technology, they don't meet that definition under the wording, and therefore there's no dependent business interruption cover," Cheshire said.
Some insurers include it as a standard extension, while others will write it in by endorsement for an additional premium. Even where the extension is there, the detail varies. One insurer’s new cyber wording, which Cheshire otherwise rated highly, required a signed letter from the supplier accepting fault before dependent business interruption cover would respond. That made claiming far harder than under competing policies.
How the loss itself is measured differs too. He said establishing whether a wording calculates business interruption on gross profit or gross revenue can require a line-by-line comparison.
One account executive is often looking after a client’s commercial combined, fleet, property and cyber, Cheshire said, and may struggle to keep across the differences between the leading cyber wordings.
Clients often take comfort from knowing their key suppliers carry insurance. Cheshire’s advice is to check the contract: in his experience, most cap the supplier’s liability for a cyber incident, almost always at the contract value.
A number of clients have been stunned by this. In one example he gave, a technology provider might carry £5m of professional indemnity and cyber cover yet be liable only up to the value of a contract worth £20,000 to £30,000 a year, a sum that would not touch the sides of a third-party claim.
Where the client’s own policy covers the loss, its insurer will typically pay and then seek recovery from the supplier. Contractual liability caps can limit what it recovers.
"Just knowing they have insurance isn't enough. We need to know what that contract says," he said.
The next question, he said, is whether that cap is negotiable and whether the limit of liability can be increased.
Across a client base, the same suppliers keep turning up. Cheshire said regional managed service providers in particular appear again and again among mid-sized clients.
"There's names that will regularly appear across our client book, and the worry therefore is, well, if something happens to them, how many of our clients will suffer?"
That was tested after the cyber incident at Beacon, a CRM provider used widely across the charity sector, which notified its customers in August. Cheshire said Gallagher's claims team handled 58 notifications in three days. Most were precautionary, but making sure every relevant insurer was notified made for a heavy claims period and sharpened the firm's focus on single points of failure. The aggregation exposure ultimately sits with underwriters, he said, but for a broker it shows up as claims workload.
As more everyday suppliers come to depend on technology, more clients will share the same points of failure, and the line many cyber wordings draw between a technology provider and every other supplier is likely to be tested more often.
