The Amazon Web Services (AWS) outage on Oct. 20, 2025, wasn’t as widespread or protracted as the July 2024 CrowdStrike outage. Even so, it wreaked havoc on thousands of websites and apps, taking “everything from Signal to smart beds offline,” as The Guardian reported.

Like the CrowdStrike outage, the AWS outage can be seen as a case study in why Cyber Insurance matters, as well as in coverage gaps policyholders and brokers must weigh.

Most Cyber Liability Insurance policies were built to cover older threats like ransomware and data breaches. Obviously, such dangers remain serious concerns.

But cyber risks are evolving faster than policy language. Business owners frequently learn, too late, that their coverage doesn’t address newer threats.

As your clients’ broker and trusted Cyber expert, you must make your clients aware of potential “blind spots” in their policies and point the way to effectively addressing them.

Issues To Keep on Your Cyber Insurance Coverage Checklist

Rapid technological changes combined with carriers’ tighter underwriting has led to new exclusions and sublimits in Cyber policies.

Cyber Insurance coverage gaps can include:

Third-Party Service Disruptions and Failures

“AWS’s outage showed that your cyber risk isn’t just about your own defenses,” says Zane Goldthorp, ProWriters’ director of broker development. “It’s about every vendor and partner you rely on to keep your business running.”

Cyber policies generally limit coverage for cloud outages and other third-party service failures. This limit is understandable. Insurers don’t know all the third parties on which your client relies, let alone those third parties’ exposure. All the same, it’s a coverage gap you must help clients address.

Contingent Business Interruption (CBI) coverage can extend a Cyber policy’s BI coverage to financial loss resulting from a cyber incident affecting a third party.

“If your business relies on the cloud, and most do,” says Goldthorp, “your exposure extends to your providers, not just your own network. That’s why Cyber Insurance matters.”

Social Engineering and Business Email Compromise (BEC)

In 2024, business email compromise (BEC) was the seventh-most reported crime to the FBI’s Internet Crime Complaint Center (IC3). Unlike broad phishing campaigns that spew thousands of generic emails, a BEC attack is a malicious masterclass in social engineering.

Attackers don’t rely on harmful links or attachments. Instead, they manipulate our human tendency to trust authority, our desire to be helpful, and our fear of negative consequences. They impersonate a CEO demanding an urgent wire transfer, for instance, or a trusted partner submitting a revised invoice with new banking details. They make their targets their unwitting accomplices, a nuance that can create challenges for insurance claims.

Many insurers do offer specific social engineering insurance endorsements or riders. While essential, even these riders aren’t silver bullets. They often come with lower sublimits than the main policy. A $1 million BEC loss might be covered only up to $100,000 or $250,000.

Social engineering riders in Cyber Insurance policies may also require stringent, predefined callback verification procedures. If employees fail to follow the exact protocol before making payment, insurers can deny the claim.

Zero-Day Vulnerability Exploits

Cyber Insurance coverage gaps in zero-day attacks are another concern. Zero-day vulnerabilities—previously unknown security flaws in software or hardware—stay unpatched and susceptible to exploitation until developers address them.

When a zero-day attack occurs, organizations face immediate risks and potential losses. Unfortunately, coverage that starts at the same instant business interruption does may not be available. Coverage is often subject to a waiting period and on a limited basis. And many policies don’t explicitly cover zero-day attacks because, by definition, the threats are unknown when the policy is written.

To bridge these gaps, businesses should work with insurance providers to negotiate terms that explicitly address zero-day vulnerabilities. They should pursue comprehensive policies encompassing a wide array of potential impacts.

Acts of War by Nation-States

Nation-state cyber activities and attacks range from sophisticated espionage campaigns to disruptive attacks on critical infrastructure. Their scale and impact can easily eclipse those of conventional incidents, since they often target such vital sectors as energy, finance, and healthcare.

Attributing cyber attacks to a nation-state requires high levels of technical expertise and intelligence capabilities beyond most private entities’ reach. Even when attribution is possible, publicly acknowledging it can strain international relations and complicate the legal landscape.

Traditional Cyber Insurance policies, typically tailored for incidents of smaller scale and isolated impact, often exclude acts of war or terrorism, leaving policyholders exposed. Until the industry finds innovative ways to assess, cover, and mitigate this risk, insured parties can only maintain and enhance their proactive cyber security posture.

Risks Related to Artificial Intelligence (AI)

Dangerous AI used to be the exclusive domain of science fiction. Today, as AI models and tools proliferate, so do the risks this technology poses to cyber security.

Generative AI lets attackers overcome barriers like the poor grammar or awkward phrasing that used to betray phishing emails. Bots can generate flawless, context-aware messages, even whole conversational threads, that perfectly mimic the tone and style of a trusted executive or vendor.

Cyber criminals can use AI to automate reconnaissance, identify high-value targets, and generate audio or video deepfakes for an extra layer of authenticity in social engineering attacks.

AI could also be used to create malware that constantly changes its signature to evade detection. Although some experts view this prospect as unlikely or even far-fetched, research has demonstrated that ChatGPT’s versatility can allow it to create just such functional polymorphic malware “with relative ease.”

AI is both an amplifier of existing threats and a source of new ones. How, for example, does a policy define fraud when it involves a deepfake voice call that replicates a CEO’s voice authorizing a payment—social engineering, a computer fraud event, or something else entirely? Lack of clarity gives carriers grounds to dispute claims, leaving policyholders in legal limbo.

For the time being, insured entities would do well to fight artificial intelligence in cyber threats with artificial intelligence in cyber security. Deploy advanced solutions that use AI to detect anomalies in communication patterns, sender identity, and language.

Collaborating To Close Cyber Insurance Coverage Gaps

Cyber Insurance remains an essential part of any risk management strategy. But as these coverage caps illustrate, not all policies are created equal.

What can you do to help your business clients mind these gaps? Confirm your clients are:

• Adhering to the most recent cyber security best practices—email authentication protocols (DMARC, DKIM, SPF), multifactor authentication, and others.
• Reviewing on a regular basis (or developing) their dedicated, detailed cyber incident response plan, which not only prepares an organization for an attack but also demonstrates due diligence to insurers and can significantly expedite claims.

Training personnel about cyber risks, to foster a culture of awareness, healthy skepticism, and resilience.

When it comes to making sure they have the strongest possible Cyber coverage:

• Review policy wording carefully.
• Ask about endorsements for vendor incidents, social engineering, AI, and other possible coverage gaps.
• Check sublimits and exclusions.
• Reassess coverage annually as digital risks evolve.

Ultimately, closing today’s Cyber Insurance gaps must be a collaboration among carriers, your clients, and you.

Here at ProWriters, our registered brokers use our Digital IQ Comparative Rate Platform to research, quote, and bind Cyber policies from industry leaders at competitive rates, easier and faster than ever before.

Find out more and get started so your clients can enjoy robust protection and more peace of mind, while you earn higher commissions and expand your book of Cyber business.