System failure, cloud outages and the CrowdStrike lesson

System failure coverage in a cyber policy pays for an outage that no attacker caused, such as a bad software update or an administrator's mistake, and dependent system failure coverage pays when a provider's outage hits your income. Neither is automatic. Each is a separate grant that may be missing, sublimited or subject to a longer waiting period, and the two largest recent outages, CrowdStrike in 2024 and Amazon Web Services in 2025, showed that insured losses came out far below the economic damage.

What happened in the two outages

Sources: CrowdStrike's incident hub, Microsoft's July 20, 2024 post, Insurance Journal, Risk & Insurance on CyberCube's AWS estimate and Moody's. All figures were preliminary modeling estimates, they use different methods, and the AWS numbers should not be added together. Parametrix separately put AWS-related economic loss to U.S. businesses at $500 million to $650 million, which is not an insured-loss figure.

Guy Carpenter told Insurance Journal in 2024 that insurers might see claims under directors and officers and property policies as well as cyber. The Cyber insurance vs tech E&O: which policy pays when guide covers how the vendor's side of such an event lands on technology E&O.

Why insured loss came in so far below economic loss

1. Waiting periods. Moody's said typical policies have a waiting period of 8 to 12 hours and used a 10-hour average. An outage that lasts a working day mostly sits inside it, especially if the form treats the waiting period as a deductible. See cyber business interruption and dependent system failure.
2. Missing or limited grants. A policy that covers only malicious attacks does not respond to a faulty update. A policy with dependent business interruption for named IT providers may not include the one that failed.
3. Retentions and sublimits. Small and mid-size losses disappear under the retention, and dependent coverage often carries a lower sublimit.
4. Small losses and claim fatigue. CyberCube noted that many organizations may judge a claim for a short outage not worth the effort.
5. Provider reimbursement. Risk & Insurance reported that AWS was expected to reimburse affected companies. That fits how cloud contracts work, as the next section shows.

What the provider's contract gives you

Cloud and software contracts usually promise a service level and pay a credit if it is missed, and little more. The Amazon EC2 SLA, for example, gives credits of 10%, 30% or 100% of monthly charges depending on uptime and says that it "sets forth your sole and exclusive remedies" unless the agreement says otherwise, with credits not entitling you to any refund. A credit against a hosting bill does not replace lost sales. This is why your own policy matters, and why contractual risk transfer: shifting liability by contract and insurance is not a substitute for it.

The CrowdStrike dispute shows the other side. Delta Air Lines sued CrowdStrike in Georgia, and in May 2025 a Fulton County judge allowed Delta's gross negligence and computer trespass claims to go forward while dismissing some fraud claims, The Register reported. CrowdStrike's lawyers said the contract would cap damages. We did not find a final outcome, so take it as an example of how vendor contracts get tested, not as a rule. Most businesses will never sue their vendor, and should plan to be paid by their own policy or not at all.

The policy words that decide payment

• "System failure" definition. Look for an unintentional and unplanned outage of your own systems. Check whether a faulty update from a security vendor you installed counts, or whether the form requires an administrator's error or a hardware fault.
• Dependent system failure. Which providers are included: cloud hosts, SaaS, payment processors, managed service providers, or any vendor? Named or defined? A non-malicious outage at the provider is the scenario that mattered in 2024 and 2025.
• Infrastructure exclusions. Many forms exclude failure of power, telecom or internet service outside your control. A cloud region is not necessarily "infrastructure" in the policy, but ask. See common cyber insurance exclusions.
• Waiting period and retention. One number for direct BI, a longer one for dependent BI? Time deductible or trigger? Coalition states on its help pages that its waiting period is a trigger and that most policies use it as a time-based retention, so the same 15-hour outage can pay differently.
• Voluntary shutdown. Taking systems offline to avoid a spread is covered in some forms and conditioned on consent in others.
• Betterment and software upgrades. Fixing the cause by upgrading is generally not reimbursed above restoring what you had.

Property policies generally will not fill the gap. Contingent business interruption under a property form, covered in contingent business interruption insurance and supply chain risk, depends on physical damage at a supplier or customer location, which a software failure does not cause.

A hypothetical: a cloud-dependent online retailer

Say an online retailer with 60 employees runs its storefront in one cloud region and loses 15 hours of sales on a weekday. It averages $9,000 of sales per hour, and its net income plus continuing expenses come to $3,600 per hour. Its dependent BI has a $10,000 retention. This is invented to show the mechanics.

Same outage, very different payments. And if customers return the next day and make up the orders, even the smaller figure may overstate the true loss. Dependent coverage earns its keep in outages that run days, not hours.

What to do before the next outage

1. Map dependencies. List the five or ten providers whose failure would stop sales or shipping. Include the cloud region, payment processor, identity provider and security software.
2. Compare recovery time to the waiting period. If you cannot work around an outage in 8 hours, the policy's waiting period is part of your exposure. The business income (interruption) limit calculator can estimate income per day, and writing a business continuity plan: a step-by-step guide covers fallbacks.
3. Test a manual fallback: phone orders, paper forms, a static website or a second region.
4. Read the vendor contract for credits, notice requirements and liability caps, and have counsel review them for key vendors.
5. Tell the broker about vendors. If the policy schedules providers, ask to add each critical one.
6. After an outage, report a circumstance. Marsh recommended, after CrowdStrike, notifying the cyber insurer and other relevant policies with a notice of circumstance, documenting the operational impact and tracking costs.

Other ways to transfer the risk

Some buyers add parametric cover for cloud outages. The NAIC's 2025 report on the cyber market describes parametric cyber products as paying on predefined events, such as a cloud region outage, rather than the size of the loss, with tight limits and objective triggers. parametric insurance is not indemnity, so the payout may not match your loss. parametric insurance for businesses explains the trade-off. Artemis reported on December 4, 2025 that Parametrix had paid claims after the AWS outage, with payment starting once policyholders returned loss confirmation. For the market-wide view, see systemic cyber risk and cyber catastrophe bonds.

Key takeaways

• System failure and dependent system failure are optional extensions in cyber policies. Confirm that yours includes both, and for which providers.
• The 2024 CrowdStrike and 2025 AWS outages produced insured-loss estimates well below economic loss because of waiting periods, retentions, sublimits and gaps in coverage.
• Cloud contracts usually give service credits, not damages, so your own policy is the main source of recovery.
• Whether the waiting period is a deductible or a trigger can change the payout by tens of thousands of dollars on a one-day outage.
• Map your critical vendors, compare recovery time to the waiting period and report a notice of circumstance after any large outage.