A new report from Lloyd's Innovation explores the systemic impacts of a future downtime incident at one of the main cloud providers. ‘Cloud Down: Impacts on the US economy’ says that while more companies rely on the cloud to operate, a select few providers have come to dominate the market. This reliance on a small number of companies creates the potential for systemic risk for service users. The report sets out a ‘detailed accumulation’ modelling approach which provides a more accurate view of risk than standard market share based approaches.
Key findings in the report include:
- The business interruption losses associated with the disruption of a cloud service provider are varied and depend on how many businesses use its services and the duration of the downtime event.
- Given the state of the cyber insurance industry today, a cyber incident that takes a top three cloud provider offline in the US for 3-6 days would result in ground-up loss central estimates between $6.9 and $14.7 billion and between $1.5 and $2.8 billion in industry insured losses.
- Fortune 1000 companies will carry 37 percent of the ground-up losses and 43 percent of the insured losses arising from a 3-6 days downtime event. Smaller companies might be more likely to use the cloud in order to avoid building the business infrastructure in-house, but insurance take-up is low compared to the Fortune1000 companies. As the cyber
insurance market grows rapidly, the distribution of risk will have to be monitored carefully. - A cyber incident that takes down a top three cloud service provider for 3-6 days would result in $4.2-$8.6 billion of ground up losses for the manufacturing industry, followed by $1.4-$3.6 billion for the wholesale and retail trade industry. These two industries will be the most affected, which holds true for the Fortune 1000 companies as well.
