Hermès Marangos considers the systemic implications of the CrowdStrike outage for the insurance industry in Insurance Day

On 19 July, the world experienced one of the biggest IT outages in history. A faulty update from cybersecurity company CrowdStrike’s Falcon product caused 8.5 million systems running Microsoft Windows to crash. Infrastructure globally ground to a halt, causing real losses for individuals and organisations worldwide.

The CrowdStrike cyber event is the most serious since NotPetya in 2022 - its impact on the insurance industry potentially enormous. NotPetya did not end well for the insurance industry, considering a misconceived attempt to challenge accepted insurance industry notions of war risks to exclude that cyber event was bound to fail. It is always better to cater for and clearly analyse such events, rather than ex-post facto trying to reinvent public and private international law.

Insured losses are estimated between USD 1.5 billion and USD 10 billion. Actual losses, which may be far greater, and the absence of cover for many of them are also points of importance reinforcing the argument that the industry is facing undealt-with systemic risks, with lessons that should be heeded by risk management teams worldwide.

Warren Buffet’s warning of the risks of issuing cybersecurity insurance and aggregation of risks given earlier this year now seems prophetic. At Berkshire Hathaway’s annual shareholder’s meeting, Buffet noted that the risks multiply the more such policies you write, and that even with a USD 1 million limit per policy, if a single event impacts 1,000 policies, “you’ve written something that in no way we’re getting the proper price for, and could break the company.” The scale of losses caused by the CrowdStrike event demonstrate Buffet’s concerns.

The question of foreseeability will be crucial in determining liability. It must have been known by many individuals that this software concerned interconnected and dependent companies worldwide, which would be impacted by the failure. It should have been clear a bug was a likely probability, and that it would have a high impact on business operations. Given this knowledge, vendors should be expected to have adequate procedures for updating software, covering how the update is developed, tested, troubleshooted, and pushed to production systems.

The insurance industry previously had to deal with “black swan” events that entailed High Impact Low Probability (HILP), which created systemic issues for insurers. If events like CrowdStrike are becoming predictable, higher impact with higher probability adds to the systemic problem already facing insurers.

Some innovators are willing to experiment in a haphazard fashion, which can increase the risk of such “black swan” events, raising the question whether any of these events remain ‘unpredictable'.  They are arguably no longer HILP events.  Innovators loath restrictions that stifle creativity, but failing to take steps to prevent predictable events may lead to an array of legal consequences.

There will inevitably be debate on what that testing process can reasonably be for those launching cybersecurity updates, who often must move fast in a ‘cop and robber’ scenario, to issue updates rapidly to protect new cybersecurity threats. IT industry commentators, in explaining the potential vulnerability in the systems refer to the fact that such updates may have to be launched multiple times per day. Moreover, other interdependent systems are also potentially being updated multiple times per day and devices can receive updates in a different order or timescale. IT industry commentators also refer to the real world not being as perfect as the test environment, and if updates go wrong, one would expect third and fourth-party exposure and potential supply chain fallout. From a lawyer’s or underwriter’s perspective, this "guinea pig" approach to technology is a nightmare scenario for class actions and systemic underwriting.

An array of insurances could be impacted, depending on final determination on whether the reason for the issue was human error or defective technology. These include property (P&C and silent cyber included), BI/CBI, professional liability, D&O (especially drop in stock value that is sustained) and product liability. The trigger for such coverage typically includes system failure resulting from non-malicious acts, including human error.  However, there is no standard cyber policy language.

Technologies with large market shares create potential single points of failure that can lead to systemic events yielding claims from a very large number of claimants at once. It shows how a small cog can bring global IT infrastructure to a halt, raising issues of insurability which cannot be ignored. Whatever the arguments, this single point failure - and extraordinarily wide impact - and its possibility to cause catastrophic cumulative losses cannot be dismissed. Once again from a legal perspective, questions arise as to whether the risks of a single point of failure for a complex, global information technology supply chain have been adequately assessed.

Agency and delegation issues also arise, and the represented security of a system when interfacing can also in other situations, not just block freeze the system, but open it up to attack.  Either way, the net effect of the CrowdStrike outage was the equivalent of an attack on a supply chain by a malicious actor.

Perhaps the issues faced during the Covid pandemic and NotPetya are merely a foretaste of the losses that future cyber events could yield.  After all, covers including silent cyber do not become non-covered events simply because they result in catastrophic losses.

There is also an impact at the reinsurance level, as there may be serious issues arising relating to the number of events and event definitions.

One must also consider the link between CrowdStrike and Microsoft.  AI experts fielded the question whether Microsoft’s system had the ability to reject the update, and revert to a previous version of Falcon, if so, why did it not do that?  Although unclear exactly how the system could do this reverting to the previous version, we are constantly reminded by AI experts that the system is like a super brain that calibrates itself and solves everything. If so, is the super brain still at work or are we listening to the wrong AI experts?

IT industry commentators refer to Microsoft commenting on the challenge of third-party vendors pushing out updates which operate in the low-level operating system in a recent blog, where they suggest changes could be made so 3^rd party applications operate higher in the operating system, making management of such issues easier;  for example, the ability to reject updates which cause “blue screens” and the need to roll back to the previous version. There is talk in the IT industry that more thorough testing of security updates and staggering of update releases to smaller groups or upgrade ‘rings’ could have averted the disaster. From a legal perspective, it is hard to ignore the fact that it all looks too predictable, especially considering how many years now there have been discussions of the dreaded “blue screens”.

Insurance companies understandably continue to chase a portion of this rapidly growing insurance market. Yet given the complexity, novelty (and non-novelty), IT industry practices. and scale of the risks involved (including legal rights and obligations), the insurance industry must give sober consideration to the ever-increasing scenarios of catastrophic losses as it becomes increasingly exposed to even more cybersecurity risks.

This article is up to date as of 6 August 2024.