A 3-Day Software Outage Cost This Firm $22,000. Its Cyber Policy Paid Nothing Because No One Hacked It.

7 min read · Last updated July 22, 2026

In this article

– What cyber business interruption coverage is supposed to do – Security failure vs system failure: the word that voids the claim – The waiting period is a deductible measured in hours – When your vendor goes down: dependent business interruption – What to check before you need it – FAQ

Marcus Ellison runs a six-person accounting firm in Columbus. On a Tuesday morning in March, a botched update from his cloud practice-management vendor knocked the whole system offline for three days. No hacker, no ransom note, no stolen data. Just a broken patch on the vendor’s side. His staff could not open client files or file returns, and clients walked. He estimated the lost billable work at about $22,000. He filed a claim under the business interruption section of his cyber policy, confident it would help. It was denied.

What cyber business interruption coverage is supposed to do

Cyber business interruption coverage is the part of a cyber policy that replaces income your business loses when a covered event forces you offline. If ransomware locks your systems for a week, this is the coverage that reimburses the profit you would have earned during that week, plus some extra operating costs. The Insurance Information Institute describes cyber insurance as covering both the direct costs of an incident and the lost business income that follows it.

That sounds like it should have paid Marcus. The problem is the trigger. Business interruption only pays when the event that took you offline is the specific kind of event your policy names. A firm reads “business interruption” and assumes any downtime qualifies. The policy language is far narrower, and the narrowness is where the money is won or lost.

Security failure vs system failure: the word that voids the claim

Most cyber policies draw a hard line between two causes of an outage. A “security failure” is downtime caused by an attack: hacking, malware, ransomware, a denial-of-service flood. A “system failure” is downtime with no attacker behind it: a failed software update, a configuration mistake, an accidental server crash. Marcus’s outage was a system failure. His policy only insured business interruption from a security failure.

That single distinction decides the claim. Standard cyber forms often cover only security-failure interruption unless you specifically add system-failure coverage as an extension. Here is how the common triggers line up.

Cause of your outage	What it means	Covered by a basic cyber BI policy?
Security failure	An attack: ransomware, hacking, malware, denial of service	Usually yes
System failure	A non-malicious crash: bad update, config error, accidental outage	Only if system-failure coverage is added
Dependent security failure	An attack on a vendor you rely on (cloud host, processor)	Only with dependent coverage, often a sublimit
Dependent system failure	A non-malicious outage at that vendor	Rarely, and only when specifically added

Before you assume your downtime is covered, find the word “security failure” and the word “system failure” in your policy and check which one your coverage actually names. If it only says security failure, a crash with no attacker leaves you paying the lost income yourself. This is the same coverage-scope trap that shows up in a business owners policy with a thin cyber sublimit: the coverage exists on paper but stops short of the loss you actually have.

The waiting period is a deductible measured in hours

Even when the cause is covered, business interruption does not pay from minute one. Cyber policies apply a waiting period, often 8 to 12 hours, before income replacement starts. Think of it as a deductible measured in time rather than dollars. An outage shorter than the waiting period pays nothing, and a longer outage only pays for the hours beyond it.

Say your policy has a 10-hour waiting period and your covered outage lasts 14 hours. You are only reimbursed for the final 4 hours of lost income. For a lot of small-business outages, which resolve within a day, the waiting period alone can wipe out the whole claim. When you compare cyber policies, the waiting period is as important as the coverage limit, because a shorter waiting period is what turns a common one-day outage into a payable loss.

When your vendor goes down: dependent business interruption

Marcus never touched the software that broke. His vendor did. When the system you depend on belongs to someone else, only “dependent” business interruption coverage, sometimes called contingent business interruption, reaches the loss. It responds when a third party you rely on, such as a cloud host or a payment processor, goes down and takes your income with it.

Dependent coverage is frequently sold as a small sublimit, a capped slice well below your main limit, or left off entirely. As more small firms run entirely on outside cloud platforms, this is the fastest-growing blind spot in cyber coverage. It mirrors the physical-world version of the same gap, dependent property coverage when a supplier or warehouse you rely on is knocked out. The lesson is identical: your income can stop because of a failure at a business you do not own, and only coverage written for that scenario will pay.

What to check before you need it

Pull your cyber policy and answer four questions. Does the business interruption grant cover system failure, or only security failure? What is the waiting period in hours? Is dependent business interruption included, and at what sublimit? Does dependent coverage extend to system failure at the vendor, not just an attack? If any answer is “no” or “not sure,” those are the exact endorsements to price at renewal.

Timing is on your side right now. Broker-surveyed cyber premiums fell 3.5% in the first quarter of 2026, according to industry reporting on the quarterly commercial market survey, a full reversal from the double-digit increases of a few years ago. A softer market gives you room to broaden coverage, adding system-failure and dependent business interruption, without the premium jump those additions would have triggered in a hard market.

Frequently asked questions

Does cyber insurance cover downtime if my business was not hacked? Only if your policy includes system-failure coverage. A basic cyber policy often covers business interruption from a security failure (an attack) but not a system failure (a non-malicious crash like a failed update). Read your coverage grant and add system-failure coverage if it is missing.

What is a waiting period on cyber business interruption? It is the number of hours your systems must be down before income replacement begins, commonly 8 to 12 hours. It works like a deductible measured in time. An outage shorter than the waiting period pays nothing, and a longer one pays only for the hours beyond it.

What is the difference between a security failure and a system failure? A security failure is caused by an attack, such as ransomware, hacking, or a denial-of-service event. A system failure has no attacker behind it, such as a bad software update or a configuration error. Many policies cover only the first unless you add the second.

My cloud provider went down and I lost income. Am I covered? Only if you carry dependent (contingent) business interruption coverage, and only up to its sublimit. This coverage responds when a vendor you rely on fails. It is often a small capped amount or left off standard policies, so confirm it is included and sized to your reliance on that vendor.

Is now a good time to expand cyber coverage? Yes. Cyber pricing has softened, with broker-surveyed premiums down 3.5% in the first quarter of 2026. A soft market is the least expensive time to add system-failure and dependent business interruption coverage before renewal.