The Hour Your Business Went Dark (and It Wasn't Your Fault)
At 3:00 a.m. Eastern on October 20, 2025, a DNS resolution failure inside Amazon Web Services' US-EAST-1 region set off a chain reaction that took down more than 3,500 companies across 60 countries. Nine days later, on October 29, a configuration error in Microsoft's Azure Front Door service knocked Microsoft 365, Outlook, and Xbox Live offline worldwide — dragging Costco's checkout systems, Starbucks' mobile ordering, and Alaska Airlines' booking tools down with it. Neither company had a fire, a flood, or a break-in. Their servers were fine. Somebody else's servers weren't, and that was enough to stop the register from ringing.
If you run a small business today, there's a good chance your point-of-sale system, your booking calendar, your invoicing tool, and your customer database all live on infrastructure you don't own and can't control. When that infrastructure goes down, you lose revenue exactly the way you would in a fire — except your standard commercial property policy almost certainly won't pay a dime, because nothing you own was damaged.
That gap has a name — contingent business interruption insurance — and understanding it is quickly becoming as basic a piece of small-business literacy as knowing your gross margin.
Why Your Existing Insurance Probably Doesn't Cover This
Most small businesses carry a Business Owner's Policy (BOP) that bundles general liability, commercial property, and a standard business interruption endorsement. That endorsement pays out when your own covered property is physically damaged — a kitchen fire, a burst pipe, wind damage to your roof — and the damage forces you to close.
The problem: a cloud outage doesn't damage your property. Your laptop, your storefront, your server closet (if you even have one) are all sitting there, physically intact, while you simply can't process an order because Shopify, Square, QuickBooks Online, or your booking software can't reach its own backend. Standard business interruption coverage is built entirely around the "physical damage" trigger, and a DNS misconfiguration three states away doesn't meet it.
Contingent business interruption (CBI) insurance exists specifically to close this hole. Instead of requiring damage to your property, it pays out when a named supplier, vendor, or partner you depend on suffers a disruption that stops you from operating. A restaurant with CBI coverage tied to its point-of-sale vendor gets paid when that vendor's outage prevents it from taking orders — no fire required.
The Trap: CBI That Still Requires "Physical Damage" Somewhere Else
Here's the part that catches business owners off guard after they think they've solved the problem: many CBI endorsements were written for the pre-cloud economy, and they still require physical damage — just at the supplier's location instead of yours. A warehouse fire at your key vendor triggers the policy. A software bug that takes down that same vendor's cloud dashboard for 15 hours does not, because nothing physical burned, flooded, or broke.
Insurance analysts have flagged this as one of the fastest-growing uninsured exposure categories in the market: a ransomware attack, a bad software deployment, or a capacity failure at a cloud provider can shut down operations just as completely as a factory fire, but most traditional CBI language was never rewritten to recognize that. If AWS goes down because of a misconfigured DNS record or an internal engineering error — rather than a cyberattack — some cyber-focused CBI riders won't respond either, because they're triggered by "security events," not garden-variety outages.
The practical takeaway: don't assume the word "contingent" on your declarations page means you're covered for this specific scenario. You need to read — or have your broker walk you through — three things:
- The trigger language. Does coverage require a "security failure," "systems failure," or does it name outages/service interruptions broadly? Systems-failure language (not just cyberattack language) is what actually covers an ordinary cloud provider going down.
- The supplier schedule. Many CBI endorsements only cover disruptions at specifically named suppliers. If AWS, your payment processor, or your SaaS vendor isn't on that list, an outage there isn't covered no matter how the trigger is worded.
- The sublimit. Some policies bundle CBI into a broader cyber or property policy with a sublimit far below the overall coverage amount — enough to look reassuring on paper, not enough to replace a real week of lost revenue.
What a Cloud Outage Actually Costs
The numbers explain why insurers are racing to write this coverage. Industry benchmarks put the average cost of IT downtime at roughly $14,056 per minute across large enterprises — a figure padded by giants with massive transaction volumes, but directionally useful: a business running $100,000 a day in cloud-dependent revenue loses roughly $29,000 an hour during a total outage of its checkout or booking system. The October 2025 AWS incident ran over 15 hours. Even a business a fraction of that size, down for half a day, can be looking at a five-figure loss before counting the labor cost of manually rebooking, re-invoicing, and reconciling everything that piled up while the system was dark.
For a bakery, a med-spa, a niche e-commerce shop, or a solo consultant, that's not an abstraction — it's a bad month, sometimes a bad quarter, and it happens with zero warning and zero fault on the business owner's part.
What Contingent Business Interruption Coverage Actually Pays For
When it's structured correctly, CBI (sometimes sold as "downtime insurance" or a cyber-CBI endorsement) typically reimburses:
- Lost net income you would have earned had the outage not occurred, calculated against your historical revenue.
- Continuing fixed expenses — rent, payroll, loan payments — that don't pause just because your point-of-sale system did.
- Extra expenses incurred to keep operating during the outage: a manual card reader, temporary staff to process paper orders, expedited software fixes.
- SLA-related liabilities, in some policies, if your own customers had a service agreement with you and you missed it because of the outage.
The Waiting Period Matters More Than the Headline Coverage Amount
Every CBI policy has a waiting period — effectively a time deductible — before benefits kick in, typically 24 to 72 hours depending on the insurer and premium level. A short outage that resolves in under a day, which describes a large share of cloud incidents, may fall entirely inside that waiting period and pay out nothing. Before buying, ask directly: "If AWS goes down for six hours, does this policy pay anything?" For many standard policies, the honest answer is no — you'd need a shorter waiting period, which costs more, or you'd need to accept that CBI is really protection against the multi-day, worst-case event rather than routine outages.
What This Costs and How to Buy It
Standalone business interruption coverage generally runs $40–$130 a month ($480–$1,560 a year) for a small operation, while a full BOP that bundles general liability, property, and business interruption averages $1,450–$2,650 a year. Contingent/cyber-CBI is usually added as an endorsement or rider rather than sold as a stand-alone product for very small businesses, and pricing depends heavily on your revenue, industry, and how concentrated your dependence is on a single cloud vendor.
Practical steps:
- Ask your current broker two questions: "Does my BOP's business interruption clause require physical damage to trigger?" and "Is there a contingent or cyber-CBI endorsement available, and does it name my actual cloud/SaaS vendors?"
- List your single points of failure — the two or three vendors (hosting, payments, booking, email) whose outage would actually stop you from serving a customer. Those are the names that need to appear on any supplier schedule.
- Negotiate the trigger wording, not just the coverage limit. A policy with a $50,000 limit that never actually triggers for an ordinary outage is worth less than a $20,000 policy that pays out reliably.
- Compare waiting periods against your real risk. If most of the outages that hit your vendors resolve in under a day, a 72-hour waiting period buys you very little.
Insurance Doesn't Replace Good Records — It Depends on Them
Here's the part that gets skipped in most coverage explainers: filing a CBI claim requires proving what you actually lost, which means proving what you would have earned. Insurers want historical revenue data, a clear before/after comparison, and documentation of the extra expenses you incurred scrambling to keep operating. A business that can't produce clean, dated financial records struggles to substantiate a claim even when the policy would otherwise pay.
This is one more argument for keeping your books in a format you fully control and can audit at any time, rather than trusting the reconstruction to whatever reporting your (possibly also-outage-affected) accounting SaaS can generate after the fact. Beancount.io gives you plain-text, version-controlled financial records — the kind of complete, dated, exportable ledger that makes a business-interruption claim straightforward to document instead of a scramble. Because the ledger is just text files under your control, it's also unaffected by a different company's cloud outage the week you actually need to pull your numbers. If you're curious how a plain-text approach maps onto everyday bookkeeping, the docs walk through the basics, and Fava gives you the visual reporting layer on top of it.
The Bottom Line
You don't control whether AWS or Azure has another bad morning — the two biggest cloud providers on earth have each had one in the past year, and smaller vendors go down constantly with less press coverage. What you control is whether a six-figure day of revenue depends on infrastructure you've never audited for coverage, and whether you can prove your losses if it does. Read your BOP's business interruption language this week, ask your broker the physical-damage-trigger question directly, and make sure the supplier schedule on any CBI endorsement actually names the vendors that could take you offline.