Day One: The Incident Unfolds
The alert doesn't come from your own systems. It arrives via a news report, a panicked email from a partner, or a notification from a cloud services provider. One of your essential third-party vendors—a payment processor, a software-as-a-service platform,
a key component supplier—has been hit by a cyberattack. Your own network is secure, but your operations grind to a halt. The first phone call you make is critical. Many policies require you to notify the insurer immediately, often before you take any other action. This is because they will connect you with a 'breach coach'—typically a lawyer from an insurer-approved firm—who will guide your response. Acting on your own or hiring your own vendors without approval can jeopardize your claim from the very beginning. The insurer's 24/7 hotline is your first step into a complicated claims process that will test both your patience and your policy's fine print.
Proving the Loss: The 'Contingent' Coverage Challenge
Your business is losing money, but the attack didn't happen to you directly. This is the central challenge of a supply chain incident, and it’s where a specific type of coverage becomes vital: Contingent Business Interruption (CBI) insurance. Standard business interruption covers your losses from an incident on your own network. CBI, which is often an add-on to a cyber policy, is designed to cover your financial losses when a named dependent partner or supplier goes down. However, 'covered' is a tricky word. The burden of proof is on you. You must demonstrate a direct causal link between the third-party outage and your lost income. Furthermore, policies vary wildly. Some may only cover disruptions from specific, named vendors, while others might exclude outages caused by technical failure or human error at the vendor, covering only malicious cyberattacks.
What's Actually Paid For? Unpacking the Fine Print
Assuming your claim is approved, the policy won't cover everything. The primary focus is on restoring your business to its pre-incident state. Covered costs typically include lost net income during the 'period of restoration' and extra expenses incurred to get your business running again, such as paying for an alternate supplier. First-party costs like forensic investigations, data restoration, and public relations efforts to manage reputational harm are also often included. But the exclusions are just as important. Most cyber policies will not cover the loss of future revenue or damage to your company's valuation or brand reputation. They also typically exclude the cost of improving your security systems beyond their original state. Furthermore, many policies have waiting periods, which act like a time-based deductible. For example, your coverage for lost income might only kick in after your business has been down for 8 to 12 hours.
The Realities of Recovery and Common Claim Denials
The claims process can be a long, document-intensive marathon. Insurers require meticulous records of all losses and expenses. This process occurs while you are in crisis mode, trying to keep your business afloat. Beyond documentation hurdles, certain types of attacks create major coverage disputes. For example, if the attack on your supplier is attributed to a 'nation-state' actor, the insurer might try to invoke an 'act of war' exclusion, a clause common in most insurance policies that can void coverage. Another point of contention is if the initial breach was enabled because your business or your vendor failed to maintain the security standards promised in your insurance application, such as implementing multi-factor authentication. An insurer can argue you failed to uphold your end of the bargain and deny the claim. These gray areas highlight the adversarial potential of a major claim, turning your supposed partner into an opponent.
