When CrowdStrike pushed a flawed software update in 2024, it did not compromise a single network through a cyberattack. It was a mistake — a routine patch gone wrong.

Yet within hours, airports blue-screened, banking systems froze, and transportation networks ground to a halt across multiple continents. The event was a stark reminder that in a deeply interconnected world, even a mundane operational error can cascade into a systemic shock.

For risk managers and the carriers that serve them, episodes like these are redefining what it means to be exposed.

The question is no longer simply whether a company’s own assets are protected; it is whether the entire web of suppliers, vendors, platforms, and infrastructure on which that company depends can withstand a single point of failure.

“Supply chain risk is one of the clearest examples of how interconnected today’s risk environment has become,” said Adrian Hall, CEO USA at Swiss Re Corporate Solutions. “A single event, whether it is a natural catastrophe, geopolitical disruption, cyber incident or extreme heat event, rarely stays contained. It can shut down a supplier, interrupt logistics corridors, delay production, and ultimately impact revenue and balance sheets across multiple continents.”

When One Link Breaks, Entire Industries Feel It

The industries with substantial vulnerability to interconnected risk span nearly every sector of the economy.

Health care, automotive, financial services, transportation, energy, and retail have all been tested in recent years — often by events that originated far outside their own operations.

Siobhan O’Brien, global head of cyber, Cyber Centre of Excellence at MSIG USA, pointed to a series of real-world examples that illustrate how a single company’s disruption can ripple outward. “Think of all of the scripts that were not filled because Change Healthcare was hacked. Think of all the car auto parts that were not ordered because nobody could get through to their systems when CDK was attacked,” O’Brien said. “But then on the other side of that coin, think of all of the suppliers that could not supply to Jaguar Land Rover.”

When software provider CDK Global was hacked, the management systems of more than 15,000 auto dealerships in North America were affected, with losses spiraling close to the $1 billion mark in a matter of weeks.

Reflecting on the Jaguar Land Rover cyber incident in the UK last summer, O’Brien noted, the roughly 5,000 impacted suppliers that prompted the UK government to create a £1.5 billion fund to support the affected supply chain.

Jeff Kulikowski, cyber and professional liability leader, Westfield Specialty

The company itself suffered hundreds of millions in lost sales, but the broader hit to the UK economy reached an estimated £1.9 billion.

“CDK Global is the largest software provider serving auto dealers and manufacturers. The outage is a reminder that industries can become deeply reliant on critical technology platforms, sometimes without fully recognizing the extent of that dependency,” O’Brien said.

Jeff Kulikowski, cyber and professional liability leader at Westfield Specialty, echoed that concern. “What’s been exposed most within these mini catastrophe events is not the direct effect of ‘my business is down.’ It’s more, ‘my business is down — what’s the domino effect among other industries or businesses?’” Kulikowski said.

The concentration of critical services among a small number of providers amplifies the problem.

Cloud platforms like AWS and Microsoft Azure serve thousands of companies and millions of users. When Azure experienced an outage in 2025 lasting six to seven hours, the disruption was immediate and widespread.

“Does the global economy have too much reliance on too few cloud infrastructure companies?” O’Brien asked. “The impact of an outage goes from one company to thousands to millions of users very, very quickly.”

Florian Richard of AXA XL, the company’s chief risk officer in the Americas and head of underwriting risk globally, confirmed supply chain disruption consistently ranks among top concerns.

“I can almost think of every single major risk out there right now — AI, cyber, geopolitics, climate — having an impact on supply chains to some extent,” he said.

Hall framed the broader pattern in systemic terms: “Risk is no longer linear; it is networked. And when risk is networked, shocks travel faster and farther than many traditional models anticipated,” he said.

“Power grids are another powerful illustration of systemic exposure. Extreme heat, wildfire, winter storms, or cyberattacks can disrupt energy infrastructure, which then affects manufacturing, health care systems, transportation networks, and data centers simultaneously.”

Carriers as Risk Partners, Not Just Policy Providers

As the nature of risk shifts, so does the role of the carrier. Experts across the industry emphasized that managing interconnected exposures requires going well beyond the traditional underwriting transaction.

“For corporate risk managers, this changes the conversation,” Hall said. “It is not just about insuring a single asset or facility. It is about understanding interdependencies across suppliers, utilities, customers and jurisdictions.”

He pointed to Swiss Re Corporate Solutions’ Risk Data & Services platform, which helps clients map exposures at the asset level and model how disruptions such as grid failure or supplier shutdowns could cascade across operations.

Siobhan O’Brien, head of cyber insurance, MSIG USA

Richard described a similar shift at AXA XL. “We dedicate so much more of our time sitting down with our clients, sharing what we know and what we hear,” he said. The company invests in thought leadership, risk consulting, and specialized units — including a geopolitics unit and a cyber center of excellence — designed to help clients understand risks that extend well beyond standard policy language. “As we think about the future of insurance, services are just as core as coverage,” Richard said.

O’Brien highlighted the value of hands-on engagement, including tabletop exercises that simulate cyber events in a controlled environment. “Working with clients, doing those tabletop exercises, sitting with them and having them see in a safe environment what this could look like for them is quite telling of how they would actually respond in a given event,” she said.

At a recent client event, MSIG USA and Coalition demonstrated how easily systems could be compromised without proper security controls. “I’ve been doing this for a long time and even I was surprised at the speed — a little too easy and a little too quick,” O’Brien said.

Kulikowski noted that Westfield Specialty has built a portfolio of risk management services and product recommendations — particularly valuable for middle-market clients that may lack the budget to purchase sophisticated security tools. “We’ve learned from our counterparts in the property space about how risk prevention/mitigation services and training can provide value and benefits to both insureds and carriers by helping to reduce the magnitude of potential future claims, and so we’re trying to do the same thing within cyber,” he said.

Stress Testing, Scenario Planning, and the Limits of Models

Predicting where the next systemic shock will originate remains an imperfect science.

But the tools and approaches available to carriers and their clients are evolving rapidly. Richard emphasized that the most effective defense is not a single technology but a cross-functional effort.

“The number one resource — whether it’s for an individual, a company, or one of our insureds — is to surround yourself with the experts you need to understand as much as possible how scenarios can play out,” he said.

At AXA XL, risk management has become a collaborative exercise involving at least a half a dozen different functions working together — a shift Richard traced back to the COVID-19 pandemic.

“Years ago, we would do some stress testing and think about an individual scenario. But now we think about multifaceted scenarios,” he said.

Richard noted that companies have proven more resilient to supply shocks since COVID, adapting faster to disruptions in trade policy and geopolitics.

Infrastructure grades from CISA, the Cybersecurity and Infrastructure Security Agency, have improved modestly — “going from a C-minus to a C, if you want to look at the positive side of it,” he said.

O’Brien observed that awareness has also grown at the corporate level, partly driven by high-profile incidents.

“I think people’s basic knowledge of their cyber exposure is probably a lot more honed now than it was five years ago, ten years ago,” she said.

Highly regulated industries like financial services tend to be most advanced, while companies that have undergone significant acquisition activity or smaller firms with limited budgets may still have gaps.

Kulikowski stressed that carriers can only underwrite risks based upon the information they receive — typically at policy inception and once a year during the renewal process, supplemented by third-party and/or publicly-available data.

The deeper challenge lies in fourth-, fifth-, and sixth-party risk: the vendors of vendors of vendors.

“We spend the bulk of our time underwriting those first level, second level, and third-party risks. But there’s the fourth, fifth, and sixth party risks as well that are incredibly difficult to identify and underwrite to,” he said.

Hall pointed to more flexible risk financing as part of the solution.

“Parametric insurance, for example, provides fast and transparent payouts based on objective triggers, which can be particularly valuable when a supply chain or power disruption causes immediate liquidity strain,” Hall said. “Speed matters when businesses are trying to stabilize operations and protect stakeholder confidence.”

Looking ahead, the consensus among these industry leaders is clear: Interconnected risk is not a passing concern but a permanent feature of the landscape. The carriers and clients that invest in advanced analytics, cross-functional collaboration, and rigorous stress testing will be best positioned to weather whatever systemic shock comes next.

“Systemic shocks are not theoretical. They are a defining feature of the current risk landscape,” said Hall.

“Our role as a risk partner is not only to provide capacity, but to help clients anticipate interdependencies, structure resilience into their programs, and emerge from disruptions stronger than before.” &