Researchers calculate financial toll of cloud outages on US business sector

A three to six-day cloud outage could cause billions of dollars of damage to US businesses, researchers have warned, prompting calls for organisations to start insuring themselves against the risk of downtime.

The analysis, co-authored by Lloyd’s of London and catastrophe-modelling company AIR Worldwide, set out to establish how much financial damage a sustained outage, involving one of the top 15 cloud providers, would do to the 12.4 million businesses that operate in the US today.

According to its authors, relatively few US firms have taken out cyber insurance policies to protect their organisations against the risk of cloud-related downtime, meaning – should the worst happen – they would collectively stand to lose billions of dollars in lost business.

“In the event of sustained downtime of a top cloud service provider, simultaneous damage for all its clients and dependents could lead to catastrophic financial losses,” the report stated.

Precisely how much would largely depend on the cloud provider, and how many businesses relied on its services, as well as the length of the outage.

It estimated that if a top-three cloud provider – such as Amazon, Microsoft or Google – went offline for three to six days, the disruption would cost its customers between $6.9bn and $14.7bn in lost business.

The report also offered a sector-by-sector breakdown of how severely US organisations operating in different vertical markets would be affected by an outage of this length involving a top-three cloud provider.

The manufacturing industry would be the worst affected, with projected losses of $4.2bn to $8.6bn, the report claimed, followed by the wholesale and retail industry, with $1.4bn to $3.6bn losses.  

“Disruption of a cloud service provider in the US market would significantly impact the manufacturing and retail trade industry, due to their heavy reliance on cloud services, and Fortune 1000 companies would carry almost half of the insured losses,” the report continued.

By comparison, insured losses for a top-three cloud provider outage were estimated to be between $1.5bn and $2.8bn.

An outage of similar length, affecting a smaller provider holding between the 10th and 15th position in the market share ranking, would generate ground-up losses of between $1.1bn and $2.1bn, and insured losses in the region of $220m to $450m.

The analysis also shone a light on the difficulties companies faced when attempting to work out how much a cloud outage was likely to cost them, as there was not a lot of historical data to base such calculations on.

“The constantly evolving nature of cyber risk makes it all the more challenging to use past events to project future losses, and the human element in cyber attacks adds to the uncertainty,” the report added.

“Cyber criminals are becoming increasingly sophisticated, attacks are happening on a larger scale and are harder to stop, and the ever-expanding internet of things is broadening the range of possible targets.”