Business interruption used to be easy to picture. A fire damaged a building. Machinery stopped. A store closed. The physical event and the interruption were visible in the same place.
Cyber incidents have made that picture less reliable.
A company can still have a building, employees and inventory while being unable to perform the work that makes the business function. Systems may be encrypted. Networks may be isolated. Orders may not move. Data may be inaccessible. A company can look open from the street while being operationally frozen.
That makes cyber insurance more than a technology product. It is increasingly part of the broader conversation about what interruption means.
The difficult questions usually sit in the details. Which system failed? What event triggered the shutdown? Was the interruption caused by malware, a security response, a vendor problem or a decision to disconnect systems as a precaution? How does the policy define the period of interruption? What evidence shows the financial effect?
Those questions matter because businesses rarely experience cyber incidents in neat categories.
A ransomware event can create forensic costs, privacy obligations, restoration expenses, lost revenue, customer disruption and contractual problems at the same time. Different parts of the insurance program may respond to different pieces of that loss.
That is why cyber coverage should not be treated as a mysterious technical appendix to the rest of the insurance program. It needs to connect with the way the business actually operates.
For a manufacturer, the critical question may be whether a network event stops production equipment. For a professional firm, it may be access to files and communication systems. For a retailer, it may be payment processing. For a logistics company, it may be the ability to locate and move goods.
The policy language matters, but so does the operational map underneath it.
A business that cannot explain which systems create revenue will have a harder time explaining the financial consequences when those systems fail. That is true whether the ultimate dispute is about coverage, valuation or the duration of the interruption.
Cyber insurance is therefore exposing something useful about insurance more generally. Coverage works best when it is connected to the real mechanics of the risk rather than purchased as a category.
The question isn’t simply whether a company has cyber insurance. The better question is whether the insurance program understands how that particular company stops working.