Does Your Cyber Insurance Cover a Supplier Incident?
When a supplier goes down, the first question is "are we covered?". The answer depends on which services rely on which suppliers, and their suppliers. Here is how dependency mapping shapes cyber insurance cover.
The policy question starts with your dependency map
When a supplier goes down, the first question from the board is usually “are we covered?”. The honest answer depends less on the word “cyber” in your policy and more on something most organisations cannot yet show: exactly which business services depend on which suppliers, and which suppliers those suppliers depend on.
Cyber policies generally separate claims made against you (third-party liability) from your own losses (first-party cover, including business interruption). Cover for your own losses when a supplier fails is often called dependent or contingent business interruption. Whether it responds depends on how the policy defines a covered supplier, which events trigger it and what conditions apply. Without a clear picture of your dependencies, you cannot test those definitions against reality.
The fourth-party blind spot
Many disruptions do not start at the supplier you contract with. They start one step further down the chain: the cloud host behind your payroll provider, the software platform your claims administrator relies on, or the data centre your payment processor uses. These fourth parties rarely appear in your contracts, your vendor register or your policy schedule.
Some policies limit dependent business interruption cover to named or contracted suppliers, or apply lower limits to others. If your exposure sits with a fourth party you have never identified, you may only discover the gap when you make a claim. Mapping dependencies beyond the first tier shows you where to ask your broker for clarification or an endorsement.
Waiting periods versus recovery time
Business interruption cover usually applies only after a disruption has lasted beyond a waiting period set out in the policy. That window matters. If you know how long each critical service can be unavailable before customers, revenue or regulatory obligations are affected, you can compare that tolerance with the waiting period in your schedule.
The comparison often reveals two things. Some outages will cause real harm but end before cover starts, so the cost sits entirely with you. Others will run long enough to trigger cover, but only if you can show which service stopped, when, and because of which supplier. Both outcomes are planning decisions, not insurance surprises, once the dependencies are visible.
Declarations need evidence behind them
Insurance proposal and renewal forms increasingly ask how you oversee suppliers: whether you assess them, monitor them and plan for their failure. Answering “yes” is easy. Showing it after an incident is harder.
If a claim is reviewed, the questions become specific. Which suppliers support the affected service? When were they last assessed? What did you know about their weaknesses, and what did you do about it? A current dependency map, assessment history and incident record give you defensible answers rather than reconstructed ones.
Questions to take to your broker
- Does the policy cover our own losses when a supplier, or a supplier’s supplier, is disrupted?
- Must suppliers be named or contracted to qualify, and are lower limits applied to others?
- Are accidental outages and system failures covered, or only malicious attacks?
- What is the waiting period, and how does it compare with how long our critical services can be down?
- What evidence and notification steps are required, and within what timeframes?
The answers should come from your policy wording, schedule and endorsements, confirmed in writing.
How VenDefend supports the conversation
VenDefend starts with where your business is exposed. It maps your business services to the processes, systems, suppliers and fourth parties that support them, so you can see which disruptions would matter most and how far their impact would reach.
Those scenarios give you sharper questions for your broker and clearer inputs for continuity planning. When an incident happens, you can record it, link it to the affected services and risks, coordinate with staff and vendors in the Messaging Centre and keep a traceable record of actions and evidence. Regular assessments and monitoring help you address weak spots before they become claims.
VenDefend helps you understand and manage the exposure. Your insurer or broker confirms which financial consequences your policy covers.