Business interruption is the hidden multiplier in cyber claims, Trisura warns

When cyber incidents hit the headlines, the focus almost always lands on ransom demands, forensic costs and sprawling legal bills. Ryan O’Leary, assistant vice president of claims at Trisura, warned that those are only the most visible parts of the loss. Speaking at the NetDiligence conference in Toronto, he argued that the real engine of severity in cyber claims is something much more prosaic – time.

O’Leary told delegates that when adjusters look at cyber claims, they increasingly see business interruption (BI) not as a secondary consideration, but as “the key driver of severity”. What really matters, he stressed, is how long a business is unable to operate because its systems are compromised. Every extra day offline inflates the claim, turning BI into “a key multiplier, rather than just another line item”.

O’Leary highlighted figures showing that claims with a BI component are, on average, 650% larger than those without. For anyone regularly handling cyber losses, he suggested, this comes as no surprise: once business interruption is in play, it reshapes the entire financial profile of a claim.

That insight forces uncomfortable questions about how the industry manages cyber events in practice. If time is the critical multiplier, then the way insurers, brokers, insureds and vendors collaborate – or fail to – becomes central to controlling loss costs.

From O’Leary’s perspective, the quality and coordination of third‑party providers sit right at the heart of that challenge. Business interruption, he said, is either extended or reduced depending on how effectively breach coaches, cybersecurity consultants, forensic investigators and accounting specialists work together. The technical details of the response may be opaque to many claims professionals, but that does not lessen their impact on the loss.

“I’m never going to understand the tech side of this industry,” he admitted, emphasising that he does not need to be an engineer to see the pattern. What matters is being able to rely on specialist partners who can execute quickly and competently, in line with clearly defined expectations. That, in his view, is where themes of trust and community come into play.

O’Leary described a model in which insurers lean heavily on established relationships with service providers they know and trust. Those partners are expected not only to fix the problem, but to do so within agreed timeframes and cost parameters. For carriers, one of the most corrosive elements in a claim is surprise – sudden jumps in scope, timeline or fees that were not flagged early. Robust partnerships, with clear scopes of work and open communication, are one of the few reliable ways to keep BI exposures under control and get insureds back up and running.

This is not just an operational preference; it feeds directly into the economics of cyber insurance. O’Leary noted that carriers are being squeezed from two sides. On one hand, BI‑heavy claims are pushing loss severity higher, as businesses grapple with longer and more complex outages. On the other hand, vendors themselves are facing inflationary and operational pressures that inevitably show up in their pricing. Claims costs, he said, will always tend to rise over time – the question is whether the industry chooses to invest in reducing the duration and impact of downtime, or simply absorbs growing losses.

For O’Leary, the answer lies in recognising that “paying for quality service providers can and will actually reduce the overall cost of claims”. Higher hourly rates or larger initial statements of work may look expensive in isolation, but if those teams can shave days or weeks off an outage, the reduction in BI exposure can more than offset the upfront spend. The real challenge for carriers is finding the right balance: investing enough in expertise and coordination to compress downtime, without losing sight of cost discipline.

That, again, comes back to trust. Trisura’s approach, as O’Leary described it, is to cultivate relationships with partners who do what they say they will do, in roughly the time and for roughly the cost they project at the outset. When those conditions are met, all parties – insurers, brokers and insureds – have a clearer view of the likely trajectory of a claim. They can plan, communicate with stakeholders and manage expectations, rather than lurching from one unpleasant surprise to another as invoices and delays accumulate.