One report estimates the economic losses from just a three- to six-day cloud breakdown could could reach $19 billion.As more companies store their information in the public cloud, they leave themselves vulnerable to significant interruptions should their cloud service provider experience a cyber attack, a natural disaster, or even an employee error. When that happens, the organizations could suffer massive economic losses that insurers will need to cover.
A recent report by Lloyd’s of London and AIR Worldwide quantifies the potential losses from a cloud service failure. The two firms estimate that a three- to six-day cloud blackout would result in total losses of $5.3 billion to $19 billion in the U. S. alone, with insured losses amounting to $1.1 billion to $3.5 billion.
The report also analyzed the impact of a cloud disruption on specific industries. Manufacturing topped the list with an estimated $8.6 billion in economic losses. The finance and insurance sector would be hit with $447 million in economic losses.
Recent Cloud Failures
The Lloyd’s of London-AIR report highlighted several recent cloud breakdowns, including a February 2017 Amazon Web Services outage for 11 hours and a pause in Microsoft Office 365 email service that kept some users unable to access the site for up to five days in January 2016. The report did not estimate the economic losses from those incidents, however.
What it does document is the growth of the cloud computing market. Lloyd’s of London and AIR notes that only a quarter of companies used a public infrastructure service as the primary platform for at least one IT function in 2015. This year, that percentage is expected to rise to 37%.
Moreover, research firm Canalys calculated that the cloud computing industry grew 43% in one year to $14.4 billion as of the third quarter of 2017. According to the firm, the top three providers in terms of market share are Amazon (31.8%), Microsoft (13.9%), and Google (6%).
Small Businesses Bear the Brunt
If a cloud service breakdown occurs, small businesses will likely bear the brunt of any financial losses. As Lloyd’s of London and AIR note, smaller enterprises outside the Fortune 1000 tend to maintain a cloud presence rather than building their own internal infrastructure. Putting those smaller companies at even greater risk is their relative lack of insurance.
In fact, smaller businesses would assume 63% of the economic losses and 58% of the insured losses — an indication of their significant exposure in the event of a cloud failure. Larger companies within the Fortune 1000, meanwhile, would suffer 37% of the economic losses, of which 42% would be insured.
For carriers and agents, the prospect of a cloud failure presents several challenges. While they need to protect and insure their vital data stored on the cloud from a lengthy disruption, they must also ensure that their clients, particularly their small business clients, have cyber insurance to safeguard themselves in the event of a cloud breakdown.
Perhaps the biggest challenge for the insurance industry is simply evaluating the risks of a cloud failure. Cyber insurance, for example, could cover business interruption or contingent business interruption (a breakdown occurring with a third-party service provider). Another issue is liability. As the Lloyd’s of London-AIR report suggests, liability may be difficult to assign because customers want providers to assume all liabilities while vendors seek to cap their liability.
Cyber insurance remains a relatively new segment in the insurance industry. As a result, the Lloyd’s of London-AIR report concludes that “the historical record alone for cyber events is not sufficient to estimate the full spectrum of impacts from future attacks.” The worst may need to happen before insurers can adequately assess these risks.