The loss is migrating outside your walls. In Allianz Commercial’s analysis of its large cyber claims — claims above €1 million, in a dataset worth more than €400 million — contingent business interruption, meaning losses triggered at a supplier, cloud host, or IT vendor rather than at the insured itself, accounted for 15% of large-claim value in the first half of 2025. In 2024 it was 6%. The share arriving through somebody else’s failure more than doubled in a year.
None of it requires an attacker. Allianz is explicit that these losses result from attacks and technical faults alike: a ransomware event at a software provider, a faulty update, a configuration error, a cloud service going dark. Allianz counted more than 48,000 outages across cloud and software services in 2025 alone, citing the tracker IncidentHub. Your vendor does not have to be breached for your business to stop; it only has to have a bad day.
A vendor list is not a plan
This is where most continuity plans quietly fail their own paperwork. A plan that lists vendors is an inventory: it answers “who do we depend on?” A plan that has been exercised against a vendor failure is a capability: it answers “what happens in hour one, and who does it?” The two documents look identical in a slide deck. They diverge on exactly one day: the day the vendor goes down, when the second question becomes the only one that matters.
Allianz’s claims people make the same distinction from the loss side. Michael Daum, its global head of cyber claims, says the workarounds that keep a business running should be defined in advance, and companies should “prepare, test and train” for interruption events. Tresa Stephens, Allianz Commercial’s head of cyber for North America, adds the upkeep: “People leave organizations, systems and suppliers change, so it’s important to have a response plan and test, update and embed it.” A vendor list performs none of those verbs.
Five questions that separate the two
Five questions separate the two. First: which single vendor failure stops revenue on day one? Not degrades it — stops it. Payments, scheduling, the system of record, the cloud host underneath all three. Most operations can name their important vendors; far fewer have ranked them by time-to-stop. If answering takes a workshop, the plan does not know its own first domino, and finding out is the cheapest continuity work there is.
Second: has the failover ever actually been run? A tabletop is the floor, not the ceiling — Allianz records an insured attacked weeks after one, whose rehearsed team kept the cost of the claim materially down. But a tabletop proves people know the script; only a live failover proves the script works: the backup environment takes real load, the data is where the plan says it is, and the cutover takes the hours the plan claims rather than the weekend it fears.
Third: when the vendor fails at 2 a.m., who answers — and is that in writing? A support tier in a sales deck is not an escalation path. The tested plan names the vendor-side contact route, the response commitment in the contract, and your own decision-maker who is reachable at that hour. If the honest answer is “we would open a ticket,” the plan has described the vendor’s ordinary Tuesday, not its worst night.
Fourth: could you actually leave? Data portability is the clause everyone assumes and almost no one tests. The practical version is narrow: has anyone ever exported your operational data out of the platform, in a format another system can ingest, on a clock? An exit that has never been performed is not an exit. It is a hope with a contract attached, and the day the vendor fails is the wrong day to discover which one you hold.
Fifth: how long does the manual workaround actually sustain the business — a tested duration, not a hoped one? When ransomware hit CDK Global in June 2024, roughly 15,000 car dealerships went back to paper for close to three weeks, at roughly US$1.02 billion in direct losses, according to Anderson Economic Group estimates reported by Insurance Business. Paper worked; that is the point and the warning. A workaround is a bridge with a load limit, and staff fatigue, error rates, and backlog all compound daily. A workaround only ever run for an afternoon tells you nothing about week three.
Insurance pays later
Insurance sits downstream of all five questions. Contingent business interruption cover, where a policy responds to a vendor outage at all, pays money later — after waiting periods, after proof of loss, on the insurer’s timeline. That money matters. But it arrives into whatever the first weeks did to your customers, your backlog, and your people, and it compensates for the outcome it finds: a business that bent, or a business that stopped. The tested plan is what decides which of those the claim is paying for.
The generalizable lesson is that the dependency list is the easiest page in any continuity plan to write, and the easiest to mistake for the plan itself. The claims data now prices that mistake: the interruption is increasingly caused by somebody else’s failure, on somebody else’s clock. So the question for your own operation is not “are our critical vendors named?” It is “which page of this plan has been run, live, against the vendor actually failing — and what did the clock say?”