Insights / Cyber

Operational Technology: When Cyber Losses Turn Physical

Operational technology (OT) is the hardware and software that runs industrial plant, power generation, manufacturing and marine operations. A cyber incident in OT can cause physical damage, safety incidents and prolonged business interruption, and the resulting loss may fall across several classes of business.

Why OT differs from IT

• Priorities. In IT, security focuses on protecting data. In OT, safety and continuity of operations come first.
• Legacy systems. Critical control systems often run for decades on old software that is operationally reliable but weak from a security standpoint.
• Connectivity. Remote maintenance and vendor access mean these systems are no longer isolated, and many businesses lack a complete inventory of what runs on their networks.

Claims considerations

• Business interruption often exceeds the physical damage, driven by shutdowns, investigation and the time needed for a safe restart.
• Early, joint investigation. Cyber forensics should work alongside engineers and adjusters from the outset to establish whether the cause was an attack or a technical failure.
• Betterment. Legacy equipment often cannot be replaced like for like, so betterment questions are likely.
• Coverage. The position depends on cyber exclusions and write-backs in property, energy and marine wordings, and on the interaction with any standalone cyber policy.

Implications for the market

Cyber-caused physical losses may already be paid under property, energy or marine policies without being identified as cyber events. A lack of recorded cyber losses in these lines does not mean the exposure is absent, which matters for accumulation modelling and for clarity of cover across a reinsurance programme.