A cyber insurance waiting period is the number of hours an interruption to the insured's systems, or to a provider it depends on, must last before business interruption cover starts to pay. It works as a deductible measured in time: the income lost inside the waiting period stays with the insured, and only the hours beyond it are covered, at the insured's lost income per hour, less any money retention and up to the sublimit. Because cyber waiting periods are measured in hours and many vendor outages last hours, the waiting period, not the limit, decides how many insureds have a claim at all. That makes it the single most important term in a cyber accumulation estimate, and the one most often left out of a first figure built from total limits. Botminds' Cyber Accumulation Management reads each in-force policy's waiting period, dependent business interruption sublimit, retention and system-failure cover before it estimates an outage, insured by insured.
The worked examples use a fictional sample book run through the solution: Thistlebrook Specialty, whose cloud vendor's US-East 3 region fails on a Monday morning. Every company in it is invented, and the waiting periods are the sample book's, not a market survey.
A 12-hour outage plus 3 hours of recovery, against five waiting periods
- Waiting period, not covered6 h
- Covered hours9 h
- Waiting period8 h
- Covered7 h
- Waiting period10 h
- Covered5 h
- Waiting period12 h
- Covered3 h
- Interruption ends inside the waiting period15 h
What is a waiting period in cyber insurance?
It is a time deductible on business interruption cover. The policy states a number of hours, and an interruption shorter than that produces no business interruption payment, however much income was lost. Wordings differ on what happens once the period is passed: the common form, and the one used on this page, pays only the hours beyond it; some wordings pay back to the start. Read your own before you model.
The idea is borrowed from property business interruption, where the deductible has long been time rather than money. A 2022 history of business interruption insurance in the NAIC's Journal of Insurance Regulation notes that "The 72-hour “waiting period” would become the norm for all business interruption policies in the mid-1990s" (Eckles, Hoyt and Marais, The History and Development of Business Interruption Insurance, Journal of Insurance Regulation, 2022). Cyber waiting periods are much shorter because digital interruptions are: an outage that stops a booking platform for a day can cost more than a week's damage to a warehouse.
How the waiting period works on one insured
Take the largest single estimate in the sample book: Calloway Freight Systems, a freight brokerage with $640 million of revenue that books loads and dispatches drivers on the failed cloud region. Its policy has a $10 million limit, a $5 million dependent business interruption sublimit that covers system failure, an 8-hour waiting period and a $250,000 retention. Its application says about 86% of revenue runs through the affected systems.
Calloway Freight Systems at 12 hours: from outage to estimate in four steps
Interruption
12 h outage + 3 h recovery = 15 h
Recovery from the application when it gives one; the book’s default when it does not.
Portfolio manager owns the recovery assumption
Covered hours
15 h − 8 h waiting period = 7 h
Only the hours beyond the waiting period are paid in this wording.
Read from the policy in force
Lost income
$640M ÷ 2,000 trading hours × 86% = $275.6k an hour
× 7 covered hours = $1.93M before retention.
From the application’s revenue answers
Estimate
$1.93M − $250k retention = $1.68M
Below the $5M dependent business interruption sublimit, so the cap does not bite.
Labelled an estimate, never a reserve
Every term in that sum is a judgement someone must own. The recovery time can easily be the largest: an insured with thousands of machines to rebuild may be down for days after the vendor is back. The income per hour depends on how much revenue truly stops; a freight broker whose drivers fall back to paper loses less than one whose bookings simply cannot be taken. The waiting period, by contrast, is printed in the policy, which is why it is the term to get exactly right.
How long is a typical cyber insurance waiting period?
There is no public survey from a regulator or academic source that gives a market average, so treat any single figure you read with care. What can be said is that cyber waiting periods are stated in hours rather than days, and that they vary by insured and by cover within the same book. In the fictional sample, the 355 insureds on the failed vendor that have system-failure cover carry waiting periods of 6, 8, 10, 12 and 24 hours, and 12 hours is the most common.
At 12 hours of outage, every waiting period up to 12 hours is passed and none of the 24-hour ones
The practical answer to "how long is typical" is therefore a distribution, and you already hold it: it is in your policy system. Pull the waiting period for every policy with dependent business interruption cover, split by whether system failure is covered, and you have the curve that decides your next outage.
What is dependent business interruption cyber?
Dependent (or contingent) business interruption is cover for the income an insured loses when a provider it relies on is disrupted, rather than its own systems. In cyber, the providers are cloud hosts, identity services, payroll platforms, managed-IT firms and software vendors. It usually has its own sublimit, below the policy limit, and its own waiting period.
The concept comes from property insurance, and so does its main trap. The NAIC journal article describes dependent properties as "premises operated by those either directly supplying or receiving goods or services from the insured", and recounts how, after 11 September 2001, a janitorial contractor for most of the World Trade Center "was denied its claim for CBI coverage as the applicable policy did not clearly identify the WTC as a dependent property" (Journal of Insurance Regulation, 2022). In cyber, the same question is whether the wording names the providers it covers or covers any provider; a named-supplier wording that omits the vendor that failed pays nothing however long the outage. The CrowdStrike replay guide shows why that mattered in July 2024.
The terms that decide a dependent business interruption loss, and where to find each
| Term | What it does to the estimate | Where it comes from |
|---|---|---|
| Dependent business interruption cover | Without it, a provider’s outage costs the insurer nothing under this policy. | Policy and endorsements in force on the event date. |
| Named provider or any provider | A named-supplier wording responds only if the failed vendor is listed. | Schedule to the endorsement. |
| System failure as well as attack | If only attack is covered, a non-malicious outage is outside the policy. | Definitions of the covered event. |
| Waiting period | Hours of interruption not paid; decides who has a loss at all. | Declarations or endorsement. |
| Recovery time | Hours added after the provider is back, before the insured is. | Application, or an approved default. |
| Income per hour | The rate at which covered hours become money. | Application revenue and the share through affected systems. |
| Retention and sublimit | Money taken off the bottom, cap on the top. | Declarations. |
Does a waiting period apply to system failure?
Yes, where system failure is covered at all, and that condition matters more than the waiting period. Many cyber policies distinguish an interruption caused by an attack from one caused by an unplanned, non-malicious failure, and some cover dependent business interruption only for the first. In the sample book, 63 of the 418 insureds on the failed vendor have dependent cover for attacks only; in a system failure they are outside the estimate before any waiting period is applied.
Insurers in the UK expect the cause to change the answer. When the PRA asked participants in its 2022 stress test whether a cloud outage caused by technological failure would change their losses, "Several entities responded that the nature of the loss would make a difference, with the majority suggesting that they would expect losses to be lower" (PRA, Insurance Stress Test 2022 feedback, January 2023). That is why the cause should be a switch in the estimate, flipped when the vendor explains what happened.
Why most insureds never claim in a short outage
Because many real outages end before most waiting periods do. The U.S. Treasury's 2023 review of cloud use in financial services describes a December 2021 disruption to several services in one region of a major provider: "The incident lasted several hours while AWS engineers identified and then resolved the problems" (U.S. Treasury, The Financial Services Sector's Adoption of Cloud Services, February 2023). An outage of several hours, plus a short recovery, passes a 6- or 8-hour waiting period and stops well short of a 12- or 24-hour one.
The sample shows the effect at book level. At 6 hours of outage, the interruption with the default recovery is 9 hours, so only insureds with 6- or 8-hour waiting periods can be past; at 12 hours, 258 of 418 are past; at 24 hours, all 355 with system-failure cover are past. The number of claims is not proportional to the length of the outage. It jumps each time the interruption crosses a common waiting period, and the most common one in a book is the one to watch.
One insured’s evidence, policy terms and estimate, with the waiting period on its own line
How the waiting period shapes the loss curve
It bends it. With waiting periods clustered at a few values, estimated loss stays small through the first hours, rises steeply as the interruption passes the common waiting periods, and then grows more slowly as sublimits cap the largest insureds. A first figure that multiplies limit by a damage ratio misses all three phases.
Estimated business interruption, gross, by outage length: small, then steep
The curve's shape is what reinsurance is bought against. In the sample, the event cover attaches at about 14.5 hours of downtime, which is just past the book's most common waiting period. Move that waiting period from 12 to 8 hours across the book and the attachment arrives earlier; move it to 24 and a one-day outage barely reaches the cover.
Outage scenarios: the curve, the waiting-period bands and the split by sector
How do waiting periods affect cyber accumulation?
They separate exposure from loss. Limit on a vendor is the ceiling: what would be at risk if every dependent insured lost everything. The waiting period distribution, with system-failure cover and sublimits, turns that ceiling into an estimate for a given outage length. A tolerance measured on limit is the right control for writing business; an estimate driven by waiting periods is the right number for the board and the reinsurers on the day.
Models face the same issue. In the cyber modelling Treasury ran for its June 2026 report to Congress, "Policy deductibles, coverage sub-limits, and business interruption/contingent business interruption waiting periods were estimated using data extracted from" the model's industry database (U.S. Treasury, TRIP Effectiveness Report, June 2026). For a market view that is reasonable. For your own book, the actual waiting periods are in your policy system, and using them is the cheapest accuracy gain in cyber accumulation. The first hour of a cloud outage shows where the policy terms enter the estimate.
Questions people ask
Does cyber insurance cover cloud outages?
Only if the policy has dependent business interruption cover that responds to the provider and the cause. Many policies cover a provider's outage only if it results from an attack, some only for named providers, and all only beyond the waiting period.
What is the difference between business interruption and dependent business interruption?
Business interruption covers income lost when the insured's own systems are disrupted; dependent business interruption covers income lost when a provider's systems are. The second usually carries a lower sublimit and can have different waiting periods and cause conditions.
Is a waiting period the same as a retention?
No. A waiting period is measured in hours and removes the income lost during them; a retention is a money amount taken off what remains. In the sample, Calloway Freight's 8-hour waiting period removed about $2.2 million of lost income before its $250,000 retention applied.
When does the waiting period start?
Usually when the interruption begins, as defined in the wording, which may differ from when the vendor's outage began or when the insured noticed it. For an estimate, start the clock at the vendor's first notice and say so.
Why do some insureds pass their waiting period long after the vendor is back?
Because their own recovery takes time once the provider is restored: checking data, restarting systems, repairing machines. The PRA's 2022 cloud scenario assumed that, after a 7-day outage, 30% of policyholders were without access for 9 days in all and another 30% for 12.
Should accumulation tolerances be set on limit or on estimated loss?
On limit for writing business, because it does not depend on assumptions about outage length. Report the estimated loss beside it, because that is what the board and the reinsurers will act on after an event.