The continuity plan existed. It had been exercised, and it still described a recovery the company could not have delivered.
Insurers understand this failure mode better than most and still struggle to quantify it. A continuity plan, like an actuarial assumption or a reserve estimate, can be technically sound but still drift from the operating reality it describes. Nobody notices until an event forces the question. At that point, the cost of not noticing has compounded past the point where it would have been cheap to fix.
That compounding is where a lot of underwriting and claims exposure lives, and the data most carriers work from doesn't capture it well. IBM's 2026 Cost of a Data Breach Report put the mean time to identify and contain a breach at 247 days (about eight months), reversing five consecutive years of improvement, while the global average cost of a breach reached a record of $5 million. The same report found that organizations making extensive use of security AI and automation shortened their breach lifecycles by 65 days and lowered average costs by $1.93 million. Two months of response time was worth close to $2 million per breach.
The Regulators Moved First
Insurers don't need an outside argument for how seriously this is being treated. The Digital Operational Resilience Act became binding across the European Union on Jan. 17, 2025, and applies directly to banks, insurers, reinsurers and investment firms. The U.K.'s parallel framework for critical third parties, set out in the joint FCA, PRA and Bank of England policy statement, took effect on Jan. 1, 2025. Both moved the compliance bar from "here is our plan" to proving under testing that critical services stay within defined recovery tolerances during a severe event. A completed annual tabletop used to satisfy an examiner. What supervisors want now is continuing evidence that a plan describes how the business runs today.
Both Sides of the Desk
The move from documented plans to demonstrated recovery reaches insurers twice, as underwriters and as payers of claims, and it doesn't appear to be fully quantified on either side yet.
On underwriting, a policyholder's stated continuity of posture and its working operational resilience are increasingly two different things, and a standard questionnaire won't reliably tell an underwriter which one is in front of them. At one multinational insurance company, 48 internal processes all depended on a single third-party vendor, a concentration that had stayed invisible through every tabletop exercise the company had run. Those controls were in place and functioning, but they had never been tested against the way the business connects to its vendors day to day. That same concentration risk is just as likely sitting inside the insurer's own operations, not only the policyholders. The question is worth turning inward before assuming it applies only to what's being underwritten.
On claims, severity depends heavily on how fast an insured understood its exposure and started making the right recovery calls. The CrowdStrike outage of July 2024 shows the range. Parametrix estimated that Fortune 500 companies absorbed roughly $5.4 billion in direct losses, with healthcare and banking hit hardest and airlines carrying the highest per-company costs, largely because recovery required manual intervention across systems that offered no fast way to trace what connected to what.
The AI Assumption
There's a version of this conversation happening now around AI, and the industry risks drawing the wrong lesson from it. The common assumption is that AI makes an organization more resilient because it can produce a continuity plan or a vendor questionnaire in minutes. That holds a statement about speed, but it says nothing about accuracy. An AI tool can generate a polished recovery plan from the same outdated dependency data a person would have used, and it can do that faster. Whether the plan describes the business any better is a separate question, and it's the one that determines what happens when something breaks.
IBM's 2026 findings suggest that the governance side is lagging behind the adoption. Close to seven in 10 breached organizations had no policy for managing AI or for spotting unapproved use of it, and breaches involving AI ran roughly $1 million above the average. That gap in governance sits squarely with operations and technology leadership, not with underwriting or claims. Deciding how AI touches resilience data is a CIO and CTO call before it's anyone else's. The easier it becomes to generate documentation, the less that documentation tells anyone about whether an organization can recover quickly. What matters more is whether someone can trace, while an event is unfolding, what a failure touches, what it cascades into next, what it's costing by the hour and what should be fixed first when the people available to fix it are limited.
None of this asks the industry to rebuild how it quantifies risk. It asks for decision speed to be treated as its own category of exposure, layered on top of whatever continuity documentation an insured already has on file. An underwriter can ask how quickly a policyholder can produce a current dependency map for a named business service and how recently that map was reconciled against the systems it claims to describe. Those two answers say more about recovery than a completed questionnaire does.
What makes a gap like the one at that multinational insurance company worth examining is how ordinary it was. The controls were in place. The plan had passed every review it was ever given, and the concentration risk only surfaced when someone tested it against how the business actually connects to its vendors, rather than whether a plan existed on paper. That distinction is the whole point. A plan on file is not the same as a plan that works, and most industries, including this one, still price the two as if they were identical. The question worth asking, of a policyholder's plan or an insurer's own, isn't whether it exists. It's when it was last checked against what the business does now.
