Cyber Insurance – If not now, then when?
In October 2026, researchers disclosed and patched PHP2Shell, critical vulnerabilities discovered in PHP using AI. PHP is a programming language used by a huge proportion (70%) of websites worldwide. The flaws could allow attackers to run code on a server or read passwords, tokens and API keys from its memory.
For businesses, such an incident could disrupt operations, expose customer data, trigger legal costs and damage customer confidence. For insurers, the concern is of one vulnerability creates potential claims across thousands of policyholders at the same time – accumulation.
This is the challenge of systemic cyber risk, and why cyber insurance needs to be understood before an incident occurs.
What do insurers worry about?
Cyber insurance generally pools premiums from many businesses, based on the expectation that not every policyholder will suffer a major loss at once. A vulnerability in widely used software challenges that assumption.
If businesses across banking, retail, healthcare and government depend on the same vulnerable component, a single flaw can create losses across industries and countries simultaneously. This is known as risk aggregation or accumulation.
Cyber insurers and reinsurers model scenarios involving widespread software vulnerabilities, cloud outages and other systemic events. They must consider not only the probability of an attack, but also how many insured businesses could be affected, how long operations might stop, and whether policy limits and reinsurance arrangements can absorb correlated claims.
How the world responded to PHP2Shell
The NSA and Europe’s ENISA urged immediate action. ENISA advised organisations to identify their PHP applications and, where fixing wasn’t possible, isolate them from public networks. Many went offline voluntarily: Japan’s weather service, parts of the BBC’s web portal, hospital and university sites, and government sites in France, Denmark, Finland and the Netherlands. Cloud and security providers, including Cloudflare, AWS, Google, Microsoft, Akamai and Fastly, issued mitigations.
From an insurance perspective, business interruption cover is often triggered by a security breach or system failure. A precautionary shutdown, taken before any attack, may not meet that trigger. Some wordings add cover for preventive shutdowns; many don’t. Emergency patching and forensics costs are likewise usually covered only after a covered event.
Insurance broker and risk adviser WTW notes that a precautionary shutdown would not ordinarily trigger cyber cover without an actual or suspected cyber incident. If compromise is suspected, or a shutdown is used to contain an incident affecting the insured or a relevant third-party provider, cover may respond, subject to the wording.
Hence, a sensible security decision is not automatically an insured loss. Businesses should check whether their policy covers voluntary shutdowns, non-malicious system failures, emergency remediation and incidents involving third-party providers.
Lessons from CrowdStrike
The July 2024 CrowdStrike outage offers a striking comparison to PHP2Shell. A faulty software update (not a cyberattack) caused widespread disruption to Windows devices and services around the world.
Estimates varied by scope and methodology. CyberCube estimated global insured losses of US$400 million-US$1.5 billion, while Guy Carpenter estimated US$300 million-US$1 billion. Parametrix estimated about US$5.4 billion in direct losses for Fortune 500 companies alone, excluding Microsoft, of which only US$540 million-US$1.08 billion of losses for those Fortune 500 companies would be insured.
Why was so much loss uninsured? Policy limits, retentions, waiting periods and the exact cover purchased all matter. Guy Carpenter noted that business interruption waiting periods commonly range from four to 12 hours in cyber policies; some losses may therefore fall outside cover.
In case of PHP2Shell, if attackers managed to harm a business on “Zeroth day” i.e. before the patch was rolled out, cyber insurance would cover it. Some policies would cover it within a reasonable grace period 3-7 days, but most policies would not cover any claims if any losses occurred beyond this grace period. Why? Because in the case of PHP2Shell, the onus lies on the insured, and a “failure to patch” would not be insurable. In case of Crowdstrike, the insured was simply exposed to a faulty update of a security tool, and they were not to blame.
A separate incident: Hyderabad
In a separate incident on October 19, 2026, a Hyderabad-based non-banking financial company (NBFC) reported a cyberattack lasting 87 minutes where 183 unauthorised fund disbursals sent more than ₹3.3 crore to 52 suspected beneficiary accounts. Around ₹40 lakh had reportedly been blocked at the time of publication.
There is no established link between this incident and PHP2Shell, and no evidence cited here that AI was involved. There is also no information whether the NBFC has any cyber insurance coverage.
But if an insured NBFC were to face such an incident, cyber insurance would pay in the following manner:
- Funds Transfer Fraud (FTF)/ Cybercrime cover: This is the primary clause for the ₹3.3 crore loss. Because the attackers gained unauthorized access to the internal API infrastructure (rather than tricking an employee into sending them), this fits the definition of unauthorized computer fraud or funds transfer fraud. However, insurers often place a “sub-limit” on direct crime losses.
- Cyber forensic and incident response costs: The policy will pay for specialized external cyber forensic experts to analyze the “system and API logs” demanded by the TGCSB (Telangana Cyber Security Bureau). They need to find the root cause, identify the security gap, and issue the “internal incident report.”
- Legal and regulatory defense costs: Covered
- Public relations costs: Covered
A cyber policy is not automatically a guarantee that stolen money will be reimbursed. The mechanism of the loss and the wording of the relevant cover are crucial.
What does Cyber Insurance actually cover?
Depending on the policy, cyber insurance may cover:
- Incident response: specialist forensic investigators, legal advisers and crisis management.
- Data and system recovery: restoring damaged systems and information after a covered incident.
- Business interruption: eligible lost income and additional expenses following a covered disruption, subject to waiting periods and other conditions.
- Privacy and legal liabilities: certain claims arising from data breaches and failures to protect information.
- Cyber extortion and cybercrime: specified extortion-related expenses or financial losses, where the policy expressly provides cover.
These protections are not universal. Some policies distinguish between malicious attacks and accidental system failures; others offer broader system-failure cover.
What should you check before buying cyber insurance?
Do not compare cyber insurance policies on premium alone. Ask your insurer:
- Under what circumstances will Business interruption be paid? Must there be a confirmed attack, or can non-malicious system failure qualify?
- Preventive shutdowns: Is interruption covered if a business voluntarily disconnects systems before an attack is confirmed?
- Third-party outages: Does cover extend to cloud providers, outsourced IT and other critical suppliers?
- Waiting periods, limits and sublimits: How much of a short outage or large loss would actually be payable?
- Security requirements: What patching, backups, multi-factor authentication, incident reporting and other conditions must the business meet?
The answer must come from the actual policy wording, endorsements and applicable law, not the product name or a general promise of “cyber protection”.
PHP2Shell illustrates how AI can accelerate vulnerability discovery, and how a shared weakness can create a common exposure for businesses worldwide.
Insurance transfers some financial risk; it does not replace prevention. Cyber insurance can be valuable, but only when coverage matches the business’ risks. Need help with that? Contact insurancepe
This blog post is brought to you by the minds at insurancepe!
Got questions or doubts about anyone insurance?
Need advice or help understanding your insurance needs?
Want the best bang for your buck when buying insurance?
We got you!
Reach out to us at:
Whatsapp/Phone: 89779 18030
E-mail: contact@insurancepe.com
Visit us at www.insurancepe.com
