How Cloud Downtime Insurance Became a Thing

A single hour of downtime from mission-critical, third-party IT service providers can cost small and medium-sized enterprises tens of thousands of dollars, but traditional insurance often does not cover these significant losses.

That’s why the founders of Parametrix Insurance came up with the idea to cover clients for short-term cloud outages, network crashes and platform failures that last up to 12-24 hours. Its products are designed to close a vital business interruption protection gap by using parametric triggers that pay by the hour.

“The product was conceived with the understanding that everything was moving to the cloud, and the cloud was becoming the right place for businesses of any nature to house and process data. But at the same time, there were associated perils—like downtime—that were excluded and restricted from most policies, creating a huge coverage gap,” according to Neta Rozy, co-founder and chief technology officer of Parametrix Insurance, a New York-based managing general agent.

“We were surprised that this risk wasn’t covered before we started operating in this space. But as we built out our product, we better understood the reasons why and structured the company and our solution to make it possible,” she said.

Waiting periods for cyber insurance and other tech-related insurance start from at least eight hours and are usually more than 12 hours.

“One of the biggest challenges in offering this type of solution is having enough reliable data on outages to develop models to quantify downtime peril,” Rozy said in an emailed interview with Carrier Management.

Previously, she affirmed, this data had not been collected in a systematic way with the necessary accuracy and reliability. As a result, the company’s first order of business was to create the monitoring systems that would independently verify uptime and downtime for the cloud and other enterprise technologies, Rozy said.

“We set out to develop a cutting-edge system to monitor SaaS, PaaS and IaaS systems around the globe for downtime events, such as cloud outages, network crashes and platform failures,” she said, referring to software-as-a-service, platform-as-a-service and infrastructure-as-a-service systems.

“The goal was to quantify and measure the peril. The millions of data points our system collects daily are the basis for our insurance products. Monitoring is external and objective, which allows us to adopt a parametric model. It’s simple, transparent, easy to understand and carries plenty of appeal to businesses,” she explained.

By developing these data-driven insights, Parametrix was able to earn the trust of insurers and reinsurers and develop “solid, business-critical insurance products,” she affirmed. “We could ascertain that cloud downtime was uncorrelated with other perils and an entirely new market directly linked the fast-growing categories of cloud and tech spend.”

Parametrix further solidified the concept that this was an insurable peril by getting valuable feedback during its participation with Lloyd’s Lab, the Lloyd’s innovation accelerator.

“Once the monitoring system was in place and we had sufficient data to model cloud outages, we were able to gain the trust of certain underwriters of Lloyds of London and other top reinsurers,” Rozy said. The company has previously revealed it has capacity provider relationships with HannoverRe, TMK and other markets at Lloyds, and has broker relationships with major brokers such as Alliant, Arthur J. Gallagher, Brown & Brown, Howden Broking, Hub International, Lockton and Woodruff Sawyer.

Parametrix’s monitoring system continuously tracks the availability and performance of all of a client’s mission-critical third-party IT services without the need for any IT installations. Once the system identifies a downtime event in one of the services a client has insured, the client is automatically notified and will be indemnified within 15 business days, at the most, according to the company’s website.

The company coverage is typically $100,000 to $5 million for an annual policy, but limits can extend to $10 million per insured. Once the policy limits have been met (from one or multiple claim events), clients can renew their policies before the year ends. There is an agreed hourly coverage rate, and the coverage kicks in in as little as one hour.

“Parametrix is relevant for businesses of all sizes, from private to public. The only prerequisite is exposure to the cloud or other third-party IT services,” Rozy continued.

The product covers damages to intangible and tangible assets during a public cloud failure. “This can include lost revenue if a website is down, lost opportunities, lost productivity, tarnished brand reputation, missed SLAs [service level agreements] and customer compensation,” she said.

Coverage can kick in as soon as an hour after the start of a downtime event, and there are no cash deductibles. A policy can last up to 12-24 hours, after which other traditional cyber policies could kick in, she explained.

The money can be used to reduce the volatility of a company’s revenue stream and support the insured’s customers for lack of service, the company explained on its website.

Proof-of-Concept

The company rolled out its first cloud downtime product in 2020 in Israel. As a result of this successful proof-of-concept program, it now also sells an expanded roster of products in the U.S., Israel, Germany, Austria, Italy and Japan (via Sompo).

“We started with cloud downtime insurance, as it is often the highest spend item for businesses after payroll and it’s also one of their fastest growing line items. Moreover, the cloud has become the host of businesses’ most mission-critical resources, assets and tools,” said Rozy.

Howden has had a relationship with Parametrix since its launch. David Rees, executive director for Howden Specialty, said there was massive interest across the globe when the product was first launched, mainly because of this unique product that has a quick and simple payout mechanism and no claims settlement process.

By contrast, if business interruption is purchased under a cyber insurance policy, “there’s a waiting period on that policy, which stipulates that the computer system has to be down for 12 hours before the policy wording agrees it is a loss and allows a claim to be made,” he said in an interview.

This, Rees acknowledged, can be crippling for some insureds whose businesses rely on these third-party services.

Downtime of cloud providers can be covered in certain cases under cyber policies, but the coverage is limited by long waiting periods of 12 hours or more, narrowly named perils and only covering specific losses, which leaves clients exposed without any real chance of compensation, a Parametrix representative explained.

Expansion Plans

This year, the company will be expanding its coverage for outages of content delivery networks (CDNs), which most enterprise sites use to make their sites fast, Rozy said.

She cited a real-life example from June of last year, when CDN provider Fastly crashed and websites such as Twitch, Reddit, GitHub, The New York Times, BBC, Lonely Planet, Shazam, The Rolling Stone and others crashed for more than an hour.

“Our plan is to cover more and more enterprise technologies and become the defacto standard for technology downtime insurance,” she said, citing other third-party IT services that are key to SMEs such as content delivery networks, e-commerce platforms, payment platforms, customer relationship management services and enterprise resource planning cloud solutions.

This article first was published in Insurance Journal’s sister publication, Carrier Management.