The Line Between Cyber and Property
The structural problem is that the two main policies were designed to not overlap, and the result is a seam. Commercial property policies cover direct physical loss or damage from a covered cause of loss. Many now contain a cyber exclusion removing loss caused by a cyber incident, and the breadth of those exclusions varies considerably. Some remove physical damage resulting from a cyber event entirely. Some carve back coverage for ensuing physical damage or for fire and explosion following a cyber event. Equipment breakdown policies cover mechanical and electrical breakdown and may or may not respond when the breakdown was commanded by software rather than caused by a component failure. Cyber policies cover first party costs and third party liability from network security and privacy events, and many exclude physical damage and bodily injury, on the theory that those belong to the property and liability policies. Some cyber forms now offer cyber physical damage coverage or a bricking extension for rendered unusable hardware, as specific add ons. So the same event can be excluded from the property policy as a cyber loss and from the cyber policy as physical damage. That seam is the thing to look for, and the specific question to ask both carriers is: if a cyber event causes physical damage to equipment or product, does your policy respond? Written answers from both sides are worth obtaining.
- Property forms increasingly exclude loss caused by cyber incidents, with varying carve backs
- Equipment breakdown may not respond when breakdown was commanded by software
- Cyber forms commonly exclude physical damage and bodily injury
- Ask both carriers in writing whether a cyber event causing physical damage is covered
Business Interruption Across Both Policies
For most automated manufacturers the larger loss is not the damaged equipment, it is the stopped production, and interruption coverage sits on both sides of the same seam. Property business interruption generally requires direct physical loss or damage as a trigger. A ransomware event that locks the supervisory system without damaging anything physically may produce no physical damage at all, which means the property policy's business interruption coverage never triggers even where the plant is fully stopped. Cyber business interruption covers income loss from a network interruption and is the right coverage for that scenario. Three details decide whether it helps. The waiting period, often expressed in hours, determines whether a short outage produces any recovery. The sublimit, which is frequently well below the cyber aggregate, determines the ceiling. And the period of indemnity, which in cyber forms is often shorter than in property forms, determines how long recovery continues, which matters when a plant restarts in stages over weeks. Contingent exposures compound this. A key supplier hit by ransomware stops shipping, or a logistics provider cannot move product. Property dependent property coverage usually requires physical damage at the supplier's location. Cyber contingent business interruption, also called dependent system failure, addresses outages at a supplier or service provider without physical damage, and it is an extension that needs to be requested rather than assumed. The practical exercise is to take your most realistic cyber scenario, a seven day supervisory system outage, and trace it through both policies, including waiting periods, sublimits, and indemnity periods. Most manufacturers find at least one surprise.
- Property business interruption generally requires physical damage, which a ransomware lockout may not involve
- Cyber business interruption waiting periods, sublimits, and indemnity periods decide the recovery
- Cyber indemnity periods are often shorter than property ones, which matters for staged restarts
- Dependent system failure coverage addresses supplier outages without physical damage and must be requested
Product Quality, Recall, and the Automated Defect
Automation changes the shape of quality failures, and this is underappreciated. A manual process produces variable defects at a low rate. An automated process produces consistent output, which means a parameter error produces uniformly defective product across an entire run, potentially for as long as it goes undetected. The automation that improves quality also removes the human who would have noticed something was wrong. That has three insurance consequences. Product liability exposure concentrates, because a defect affects a defined and potentially large population of units. Recall exposure concentrates for the same reason, and the recall is easier to scope if traceability is good and nearly impossible if it is not. And the triggering event may be a software change, a sensor drift, or a configuration error rather than a material or component problem, which affects how the claim is investigated and whether anyone else shares responsibility. Two protections matter beyond coverage. First, traceability at the lot and unit level, tied to process parameters, so that a defect can be bounded in hours rather than weeks. Modern systems record this automatically, and the value shows up only during an event. Second, change management on the controls environment: documented approval, testing, and rollback capability for every parameter and software change, with a record of who changed what and when. That record is both the quality control and the evidence of whether a vendor or integrator contributed. On the contract side, integrator and vendor agreements should be read for limitation of liability and indemnity, because they frequently cap the integrator's exposure far below the consequences of a controls error.
- Automation produces uniform defects, concentrating product liability and recall exposure
- The trigger may be a software or configuration change rather than a material defect
- Lot and unit level traceability tied to process parameters bounds a recall quickly
- Change management records on the controls environment are both quality control and evidence
Underwriting, Segmentation, and What Carriers Ask
Underwriters have become considerably more specific about operational technology, and the questions are worth knowing in advance because the answers drive both availability and price. Expect questions about network segmentation between the business network and the plant floor, remote access to control systems and whether it requires multifactor authentication, whether vendors and integrators have standing remote access and how it is controlled, patching practice on control systems including how legacy systems that cannot be patched are isolated, backup of controller programs and recipes and whether restoration has been tested, inventory of connected devices, monitoring of the operational technology environment, and whether an incident response plan addresses a plant floor event specifically rather than only an office data breach. That last point is where many manufacturers are weakest. An incident plan written around a data breach does not help a plant manager at two in the morning deciding whether to keep running a line whose supervisory system is behaving oddly. A short operational technology annex covering who has authority to stop production, how to run in manual or degraded mode, how to isolate the plant network from the business network, and who to call, including the cyber carrier's hotline, is high value and low cost. Vendor remote access deserves its own mention, because it is both a common attack path and a common finding. Standing always on access for an integrator is convenient and hard to defend. Access on request, time limited, with multifactor authentication and logging, is the practice carriers expect.
- Carriers ask about segmentation, remote access controls, patching, and controller program backups
- Legacy systems that cannot be patched need documented isolation
- Add an operational technology annex to the incident plan, covering authority to stop production
- Replace standing vendor remote access with time limited, authenticated, logged access
Frequently Asked Questions
Related Resources
This article is for general information and is not a substitute for policy language or professional advice.