A company does not have to be the direct target of an attack to lose revenue. An outage at the service handling orders, payments or employee access can be sufficient. Counting owned servers and checking for antivirus software cannot fully describe that exposure.
Lloyd’s half-year 2026 report treats digital and financial infrastructure as interconnected sources of risk. For a business, the practical question is which external dependencies can interrupt operations and which of those scenarios are actually addressed in its insurance contract.
A backup supplier can share the same dependency
Consider an online retailer using a cloud platform, external identity service and payment gateway. It signs with a second provider, but both systems use the same data centre or network route. There are two contracts, yet the critical dependency remains shared. This is an illustrative scenario, not an account of a particular company.
Testing redundancy therefore has to reach the resources required to complete an operation. A second application is not an alternative communications route. A copy of data is not proof that it can be restored quickly into a working environment. A tested switchover is more informative than a list of backup services.
Cyber policies do not cover all outages in the same way
The Lloyd’s Market Association classification of cyber-war clauses shows differing approaches to state-backed attacks. The association also notes that application depends on law, jurisdiction and the facts. This supports neither a claim that every attack is covered nor an assertion that all such losses are invariably excluded.
A buyer should describe the event before negotiating the limit. A malicious attack, a technical error and physical damage to a communications link can produce similar downtime but be treated differently by a contract. The provider involved, waiting period, sublimit and evidence supporting the loss also need examination.
| Dependency | Continuity and contract checks |
|---|---|
| Cloud platform | Independence of the fallback environment and tested restoration |
| Connectivity | Separate physical routes and switching time |
| Payment service | Ability to accept payment through another method |
| Identity and access | Operation when a shared identity provider is unavailable |
| Insurance | Cause, provider, waiting period, limit and exclusions |
Lost revenue is not automatically the insured loss
If a business misses AZN 30,000 of orders during an outage, that does not establish a claim for the same amount. Some customers may return, certain costs may be avoided and recovery may create additional expenses. A defensible calculation needs deferred versus permanently lost sales, variable costs and steps taken to mitigate the damage.
In a hypothetical FinFly example, permanently lost sales of AZN 30,000 and avoided variable expenses of AZN 18,000 reduce the contribution towards fixed costs by AZN 12,000. Justified additional expenses may also matter before the policy terms are applied. This is a management illustration, not a formula for a guaranteed insurance payment.
A practical starting point
A useful register for a local business can be short: the critical operation, the service it needs, the provider, the underlying infrastructure and the time the company can operate without it. Each scenario can then be matched to a technical workaround, a responsible employee, available cash and the relevant policy provision.
Protection depends on these decisions working together. Insurance can finance the agreed portion of consequences, but service restoration needs to be organised independently of the speed of claims settlement. That is why a dependency map is a financial-management document as well as an IT tool.