Business Interruption: Invisible and Intangible Risks

As more business interruptions stem from complex, interconnected and intangible risks, businesses and insurance providers alike must improve their operational risk management strategies to stay resilient.

Key insights

In an interconnected and increasingly digital world, operational disruption impacts are increasingly indirect and intangible in nature.
Supply chain volatility, cyberattacks and loss of attraction are potential sources of non-damage business interruption.
With disaster recovery plans often pushed beyond standard coverage and indemnity periods, businesses are exposed to underinsurance and uninsured losses.
Now more than ever, resilience depends on how well continuity planning and risk transfer solutions work together to plug gaps and get businesses back up and running, whatever the impact.

Connect With Us

Traditional business interruption insurance was based on physical damage and harks back to an era when fires, floods and other hazards were the most likely source of financial loss and disruption. But the world has moved on. In an interconnected, digitally driven global economy, interruptions can arise just as easily from supply shortages, civil unrest or public health events.

"Non-physical damage is about the financial impact of disruption, even when nothing is physically damaged," explains Mike Matthews, commercial director — EMEA at Artex Risk Solutions, Gallagher. "Events like system outages or supply chain disruption can still hit revenue and increase costs, and they can also affect reputation in a very real way."

The nature of modern value chains makes businesses more vulnerable to risks beyond their immediate control or proximity and requires a new approach to operational risk management. These realities are also challenging the insurance industry to rethink its approach and come up with solutions that are fit for purpose in today's environment.

“

Even when there's no physical damage, disruptions today can still have a serious financial impact — from lost income to reputational harm.

Mike Matthews, commercial director — EMEA, Artex Risk Solutions, Gallagher

The last six years of polycrises have made organizations more aware of their expanded risk landscape. "An agile mindset has become increasingly important for maintaining resiliency," says Bob Perlman, executive vice president of Business Continuity Planning at Gallagher. "You might not know where the next curveball will come from, but you can be prepared to respond."

"Business continuity today needs to embrace an all-hazards risk mitigation strategy," he explains further. "It is vital to be prepared for the unexpected. Relying solely on specific plans for on-site damage or having separate crisis response strategies for each risk is no longer sustainable."

A new reality for risk: Invisible, intangible, inevitable

The turn of the decade into 2020 marked an inflection point in the global risk landscape. Threats became more systemic, widespread and multi-regional. A convergence of risks, including the COVID-19 pandemic, extreme weather events and geopolitical flashpoints, halted business operations worldwide and heightened global economic uncertainty.

Six years in, business crises have continued to deepen amid supply chain volatility, geopolitical conflicts and trade disputes. At the time of writing, energy security was again in the spotlight following the closure of the Strait of Hormuz and the rising cost of oil.

"Many of the biggest operational disruptions we are seeing weren't on anyone's risk register," notes Hugh Morris, Strategic Risk Management team leader at Gallagher. "What they expose are vulnerabilities at critical choke points in an increasingly global system. The impact of them is instantaneous and felt across multiple industries and regions."

With businesses leaning more than ever on data, connectivity, third parties and global networks rather than owned assets, the dependencies often extend into larger, unmapped systems. Today's risks create exposures that businesses often cannot fully predict or control.

Seemingly unrelated triggers can compound across complex systems. As such, the largest BI losses often arise from non-physical events such as cyber incidents, IT outages and supply-chain failures, rather than from direct property damage.

A snapshot of top drivers of business interruption in 2025

Businesses reporting supply‑chain losses; 68% remain underinsured.

Increase in global trade restrictions and sanctions.¹

Global uncertainty driven by cross-border economic spillovers.²

Cause of business interruption: Extreme weather and related outages.³

Disruptions across core sectors are driven by staffing shortages.

[Cyber (48%),⁴ manufacturing (70%),⁵ construction (78%)⁶].

Average losses from a single data breach disruption.⁴

Source: Gallagher Redrawing Global Supply Chains Survey

What's disrupting business today

Contingent and supply chain interruptions

Modern supply chains are complex webs spanning multiple regions with critical inputs often sourced several layers upstream. Disruptions can cascade through the supply chain and halt production, even when the business itself sustains no direct loss.

Persistent shipping chokepoints driven by geopolitical tensions are a prime example. Economic tools like sanctions and trade tariff policies are affecting logistics routes more frequently, forcing firms to reroute shipments through secondary corridors that extend transit times and compound business interruption impacts.

"Even tangible business interruptions, such as equipment failure, are now interdependent on external support from manufacturers or specialist technicians. This may extend repair and replacement timelines by weeks or months," notes Perlman.

Despite improvements in data and analytics, supply chain visibility in many organizations remains limited beyond the first tier of suppliers, making it difficult to identify vulnerabilities and build resilience. And while stockpiling or onshoring may provide some buffer to geopolitical risk, it can mean swapping out one type of exposure for another.

As Hugh Morris notes: "The challenge with multiple local avenues of supply is heightened susceptibility to regional risks. A single natural disaster can impact multiple suppliers in the same area, often in the same industrial sector."

Cyber and technology-related interruptions

Cyber-related outages can also drive business interruption without physical repercussions in the traditional sense. An interconnected digital world, combined with the capabilities of generative artificial intelligence, allows threat actors to exploit a single vulnerability to trigger a multi-sectoral, multi-regional operational disruption.

Compromise of the software supply chain — whether through malicious code, faulty updates or a digital denial of access — can force widespread operational shutdowns as organizations isolate systems.

Utility-driven interruption

Another key concern is critical infrastructure — the damage caused by weather or other events, its resilience and the implications, such as power outages. The increasing demand on power networks can also result in load shedding, scheduled outages and precautionary blackouts that disrupt operations. The impact of such outages can also propagate across dependent systems, such as telecommunications.

Disruption to fuel infrastructure and, as a result, transportation can similarly restrict mobility, access to input or workforce availability. Often, utility-based interruptions are characterized by wide-area/global stress rather than localized failure, amplifying non-damage business interruption (NDBI) losses through capacity constraints and systemic dependencies.

Workforce and skills availability

One of the major consequences of these global shifts is the growing issue of talent and staffing shortages. Approximately two in five firms face skills gaps which are estimated to cost $1.1 trillion in lost output.⁷

"Your workforce remains a major asset," says Aidan Hewitt, director of Cultural Change Consulting at Gallagher. "Long-serving employees can act as a buffer against interruptions by acting as knowledge hubs to smoothen operations during potential disruptions.

"It's essential to view your people as both an advantage and a potential risk, if not managed properly."

Rethinking business interruption: From cause-based disruption to impact-driven business continuity

The indeterminate nature of risks today has prompted businesses to ramp up their resilience buffers. Clients are increasingly approaching continuity planning from an all-hazards perspective, focused not on specific perils, but on their ability to recover from any disruptive incident.

A business impact analysis (BIA) acts as an engine of this approach, helping prioritize the disaster recovery planning process, which is foundational to an effective business continuity plan (BCP). It informs decisions around resource allocation, recovery time objectives and contingency planning, clarifying which dependencies, suppliers and systems are essential to sustaining operations under stress.

"When businesses preemptively prepare contingencies for expected risks, they are vetting their future susceptibility to local threats," explains Bob Perlman. "When done repeatedly, these strategies become muscle memory."

Consequently, the updated operational risk management and crisis response strategies arising from such an impact analysis often seek to strengthen and broaden the firm's insurance coverage. Gallagher's global survey highlights an evolving risk appetite among businesses:

As the risk landscape becomes more intangible in nature, understanding agile risk mitigation strategies, insurance coverage levels and payout timing of risk transfer solutions becomes critical to the overall recovery picture. According to Gallagher's supply chain research, businesses want more flexible insurance products and tailored risk assessments to help them identify key vulnerabilities and potential gaps in cover.

Notably, many organizations now draw on multiple external data and insight sources — including business risk indices, horizon-scanning reports and industry risk barometers — to guide priority setting and resource allocation for a more holistic crisis response strategy.

Taking a proactive approach to business continuity planning helps organizations respond more effectively when things go wrong — and reduces insurance liability. As Mike Matthews explains, "The aim is to have insurance and planning working together so businesses can get back up and running quickly, with clear disaster recovery plans and faster responses to disruption."

He adds: "Business continuity plans shouldn't sit on a shelf — they need to be regularly reviewed, tested and updated to keep pace with how the business operates."

Consequently, exhibiting preparedness comes with its own resilience dividends. For instance, parts of the BCP implementation cost are absorbed by the insurer.

"Well-tested continuity plans can be used to stabilize premiums and even proactively reduce insurance costs," says Alush Garzon, managing director of Gallagher's US Retail Manufacturing practice.

Coverage-ready business continuity: Five questions to stress-test resilience assumptions

How quickly do operational disruption and financial impact escalate if critical data or systems are unavailable for several days?
What halts production or service delivery if a key upstream supplier or service provider fails?
How do disruptions affect revenue, reputation and recovery time across different scenarios?
Which dependencies — people, technology, utilities or third parties — most constrain timelines for disaster recovery plans, and are these reflected in indemnity periods?
How quickly can liquidity be accessed to support business continuity measures while recovery is underway?

Despite these improvements, there remains a disconnect between how business interruption insurance was designed to respond and how businesses experience disruption today.

Challenges in traditional insurance coverage for business interruption

Underinsurance and indemnity periods: Many policies have insufficient indemnity periods, which may not account for extended recovery times during wide-area events like hurricanes, which can be further compounded by labor and material shortages amid supply chain disruption.
Physical damage triggers: Business interruption policies are often tied to physical damage triggers, leaving gaps for intangible risks like cyber events or supply chain disruptions.
Valuation accuracy: With disruption events lasting well beyond the trigger, the value of loss often extends beyond immediate repercussions — something that current policies do not factor in.

Modern shockwaves that caused operational disruption: A business interruption case study

Grounded by uncertainty | When precaution, not damage, halted the European airspace

In 2010, an Icelandic volcanic eruption dispersed ash across European airspace. Although aviation infrastructure remained intact, uncertainty about the ash cloud's extent and the absence of defined safety thresholds for jet engines led to the grounding of 80% of European air traffic, stranding over 10 million passengers.⁸

The resulting shutdown — driven by precaution rather than physical damage — became the largest disruption to air travel since 9/11, causing an estimated $1.7 billion⁸ in direct airline losses and roughly $4.7 billion in wider economic impacts.⁹ As the head of the International Air Transport Association noted at the time, airspace was closed based on theoretical models rather than observed operating conditions.

Eroded from within | When routine procurement quietly disrupts the business

On average, organizations lose up to 5% of annual revenue to fraud and errors.¹⁰ These losses are embedded in routine procurement activities, with common entry points for such activities being via collusion between employees and suppliers, and during invoicing/bidding processes. Often, fraudulent documentation facilitates such wrongdoing.

These practices, in turn, open businesses to multiple liabilities. Their cumulative impact emerges only in hindsight: In FY2024, enforcement actions recovered $2.9 billion,¹¹ largely linked to long-running procurement fraud. This represents an intangible, recurring business interruption — one that never shuts operations down yet steadily erodes financial performance and public trust.

Notably, many organizations have seen a spike in such activity following the COVID-19 pandemic, driven in part by pandemic-related operational disruptions.

Small constraint, big impact | When a non-substitutable input sets the limits of the AI boom

In early 2026, geopolitical disruption created a significant (approximately one-third) supply bottleneck for helium production and export, leading to a 100% spike in helium spot prices and directly impacting the technology sector, especially AI.¹² Helium, a minor but irreplaceable input in various stages of advanced semiconductor manufacturing — water cooling and leak detection, among others — has no viable substitutes and degrades within 45 days during transport and storage.

Although chip factories remained operational, the supply chokepoint forced manufacturers to slow down production, prioritize selecting product lines or absorb yield losses. The trickle effect led to a limiting of AI accelerator production, affecting data-center buildouts and a slowdown of AI GPU availability, despite strong demands for both.

As analysts noted, the disruption did not halt production outright but dictated the rate at which the AI industry could scale.

Traditional BI coverage vs. modern realities: Where's the gap?

Traditional BI and CBI coverages	Modern BI realities
Trigger: A covered peril causes direct physical damage to insured property.	Trigger: Interruption arises from non-physical, systemic or dependency-based failures.
Clear, linear causation logic: Damage occurs first, business interruption follows as a direct consequence.	Indirect, diffused causation logic: Operational disruption happens due to loss of access, connectivity, capacity or service and no asset damage.
Nature of loss: Damage can be clearly attributed to a specific peril and location. Loss of income is a primary financial consequence of the same event that damaged the asset. Contingent business interruption (CBI) follows same logical assumptions, shifting only the location to the primary supplier.	Nature of loss: No single point of failure — losses are hard to localize or attribute to a specific event or asset. Loss of income is a secondary or emergent effect of broader system failure.
Restoration framework: Continuity planning and the risk transfer solution coverage are both tied to a finite, time-bound restoration period based on physical repair or rebuild.	Restoration framework: Disaster recovery plans are no longer time-bound by physical restoration and may depend on third parties or systemic recovery.
Risk transfer solution effectiveness: Risks are well recognized, defined and priced within policy frameworks.	Risk transfer solution effectiveness: Buyers face recognized but hard-to-quantify and thus hard-to-transfer risks, exposing coverage gaps.

Expanding the business interruption risk financing toolkit: Alternative risk transfer solutions and captives

Alternative risk transfer solutions, such as captives and parametric insurance, are helping close the protection gap for intangible BI risks.

Because captives are directly aligned with the risk profile of their owners, they offer flexibility in coverage design, limits and triggers. This makes them well-suited for intangible and emerging risks where exposures are evolving, and loss data is still developing.

"These types of risk transfer solutions allow businesses to take on the risks they understand and manage well, while transferring only the more extreme exposures that could really impact earnings," explains Matthews. "Captives can play an important role here, particularly for more frequent, non-damage-related disruptions."

Notably, captives are particularly effective for:

Retaining high-frequency, non-physical losses
Aggregating exposures across geographies, business units and risk types
Piloting, incubating and eventually transferring emerging risks to the commercial market
Delivering multi-line solutions that address overlapping and potentially systemic risks

By contrast, the appeal of parametric models is that they trigger quick payouts after events, enabling immediate financial relief. Policyholders receive a lump sum financial settlement when pre-agreed triggers — such as system downtime durations — are met or exceeded, without the need for loss adjustment.

Parametric structures are highly customizable, enabling organizations to tailor coverage to specific exposures and hard-to-insure risks.

Importantly, parametric business interruption solutions are being developed with triggers linked to shipping delays, cyber outages, cloud service disruptions or weather indices, providing faster and more predictable liquidity to manage operational disruption and stabilizing cash flow following systemic or non-physical events.

In the hospitality industry, parametric solutions can provide compensation for the loss of attraction that occurs when a hurricane is forecast but does not ultimately cause direct property damage.

As Douglass Mills, senior vice president of Operations at Gallagher, notes, "Parametric solutions respond when disruption is triggered — releasing cash as soon as predefined conditions are met, even where there's no physical loss to adjust. That enables businesses to manage non‑damage operational disruption, from evacuations and canceled travel to forecast‑driven drops in demand, while continuing to pay staff and cover operating costs."

Building business continuity and operational resilience for future disruptions

Six steps to manage future business interruptions

1. Embed data‑driven continuity planning

Use business impact analysis (BIA) to pinpoint critical processes, dependencies and chokepoints, then translate findings into clear investment and redundancy priorities.

Let impact analysis drive practical trade-offs: what to protect, duplicate, redesign or exit to make the value chain less brittle.

2. Build agile governance and compliance structures

Back business continuity with clear governance: documented plans, defined roles and escalation paths, including for emerging risks (e.g., AI).

Aligning with recognized standards where useful (e.g., ISO) to formalize accountability and speed decisions during disruption.

3. Stress‑test — and continuously adapt — business continuity plans

Design plans to handle the unexpected: treat digital resilience as core, run regular multi-scenario exercises and use monitoring to keep plans current and usable under pressure.

4. Prioritize resilience over efficiency in supply chains

Reduce supply-chain fragility by adding redundancy: diversify suppliers, widen geographies and create alternate routes/capacity so operations can survive volatility.

5. Integrate people risks into continuity planning — and disaster recovery planning

Treat people as a key dependency: plan for turnover, cross-training, knowledge transfer and role coverage so capability doesn't become a bottleneck.

Build workforce disruption scenarios into risk registers and recovery playbooks and consider financial backstops where appropriate.

6. Use innovative risk transfer solutions to close protection gaps

Combine risk mitigation strategies (e.g., retainer agreements, backup manufacturing) with alternative risk transfer solutions to fund gaps that traditional insurance won't cover.

Use these structures to protect liquidity and prevent operational shocks from becoming solvency issues.

For some companies, recovery from a shock event ends there. For others, it marks the beginning of a more structured approach to risk, shifting from reactive risk mitigation for business interruptions to resilience-building.

In a world where a local event can ripple into a global outage, answering the "what-if" is key to being prepared and shortening the length and impact of potential operational disruptions. "When it comes to ensuring business continuity, it is not just about knowing what's happening," says Garzon, "It's about asking, well, if that happened to us, our suppliers or our customers, what would we do?"

With non-damage business interruptions now a feature of the operating environment, the differentiator is resilience and preparedness: the ability to absorb shocks, adapt quickly and keep serving customers even when the goalposts have changed.

That means training continuity for real-world disruption. "Which is why, continuity must now train for: decision-making and business as usual under imperfect environments with multiple, simultaneous constraints," concludes Perlman. "Businesses that can bridge this mindset gap are those that will win in this business interruption era."

To get there, organizations should stress-test their highest-impact NDBI scenarios, align continuity plans with the realistically timed disaster recovery plans and work with brokers and insurers to structure coverage and alternative risk solutions that provide timely liquidity when disruption hits.

Published August 2026

Sources

¹"Large Increase in New Tariffs but Also Measures to Ease Global Trade, WTO Report Shows," World Trade Organization, 2 Dec 2025.

²Gillmann, Niels. "A Global Network of Economic Policy Uncertainty Spillovers," Springer Nature, 13 Jun 2025.

³"Complex and Interconnected Risk: The BCI Horizon Scan 2025," Business Continuity Institute, 19 Nov 2025.

⁴"Cost of a Data Breach Report 2025," IBM, accessed 16 June 2026.

⁵"The 2025 Pulse of Quality in Manufacturing Survey Report," ETQ, accessed 16 June 2026.

⁶"2025 Workforce Survey Analysis," Associated General Contractors of America (AGC) and NCCER, accessed 16 Jun 2026. PDF file.

⁷"$1.1 Trillion at Stake: Pearson Report Urges Action, Solutions for Skills Gap," Pearson, Jan 2025.

⁸"The Impact of Eyjafjallajökull's Volcanic Ash Plume," International Air Transport Association (IATA) Economic Briefing, May 2010. PDF file.

⁹"The Economic Impacts of Air Travel Restrictions Due to Volcanic Ash," Oxford Economics, accessed 16 Jun 2026. PDF file.

¹⁰"ACFE Report to the Nations: Organizations Lost an Average of More Than $1.5M Per Fraud Case," ACFE, 20 Mar 2024.

¹¹"False Claims Act Settlements and Judgments Exceed $2.9B in Fiscal Year 2024," U.S. Department of Justice (DOJ), 15 Jan 2025.

¹²Sideco, Francis. "Helium Crisis Tightens Grip on Global Chip Supply Chain," Forbes, 7 Apr 2026.