Outsourcing Risk

Many bad decisions aren’t intentionally poorly reasoned.
They’re reasoned with confidence against imprecise goals.

What You’re Actually Signing

Next time a vendor contract lands on your desk for signature, ask yourself: does this reduce the odds that something goes wrong, or does it merely transfer your worry about it onto someone else? In the moment of signing, those feel like the same decision. They are not the same purchase.

“Outsourcing risk” is a common phrase that obscures the difference. It bundles two distinct products, bought from two different parties, into one comfortable sentence.

Outsourcing the probability is real, and it is the more valuable half of the purchase. Choosing a vendor whose entire business is secure infrastructure genuinely lowers the odds of a breach, because security is what they do all day rather than a side task. That is not a consolation prize for the limits of contracts. It is the part of the transaction that changes what actually happens to your data.

Outsourcing the liability is a separate purchase: who is on the hook for how much if the system fails. Signatures on HIPAA Business Associate Agreements (BAAs) and certificates of insurance are evidence of this second purchase. They say almost nothing about probability.

The phrase “outsourcing risk” survives on usefulness, not on precision. “We’re covered” closes a meeting. “It’s HIPAA compliant” closes a deal. Nobody re-derives what these words actually assert, because the phrase works well enough most of the time. The gap between the phrase’s easy assurance and what you may or may not have actually accomplished stays invisible until an event tests it. Such events are rare enough that most people signing such agreements have never seen one land.

The Ladder

Every compliance and insurance relationship a company holds sits on the same four-rung ladder: vendor, insurer, reinsurer, government. Climb it in order. A customer shifts risk to a vendor through a contract. A vendor shifts its own exposure to an insurer through a policy. An insurer, worried about a single catastrophic event rendering a whole book of policies payable, shifts a slice of its exposure to a reinsurer. And when a loss is large enough to threaten an entire industry or financial system, the last party standing is the government.

At each rung, the transaction looks identical: a party agrees, for a fee, to hold a defined risk up to a defined limit. No rung certifies that the risk has gone away. Each one only agrees, in advance, on who pays and how much. That agreement is priced against an estimate of the potential loss, not precognatively against what the real losses end up being. Risk is not eliminated by climbing the ladder. It’s deferred and re-priced, one rung at a time.

When an event finally arrives, either the estimates hold or they do not.

Rung One: The Vendor’s Promise

The customer-vendor relationship is where most executives believe risk transfer begins and ends: sign a contract, collect the vendor’s compliance evidence, and treat the resulting package as proof that the risk has been handled. Update yearly. Done.

Delta Air Lines’ 2024 dispute with CrowdStrike shows what that package is worth once tested. A faulty software update forced Delta to reset 40,000 servers by hand and to cancel about 7,000 flights (Cybersecurity Dive, 2024); Delta told the SEC the outage cost it at least $500 million (Insurance Journal, 2024). CrowdStrike’s security certifications were all in good standing: FedRAMP High, SOC 2, and ISO/IEC 27001:2022. Each attests that a defined set of controls was examined and found working, in a defined environment, on a defined date. None of them spoke to whether an update would be tested before it shipped into production, which is what failed.

The liability side was in order, which turned out to be a problem for Delta. The contract capped liability and excluded consequential damages. Delta sued. In 2025 a Georgia court let its gross-negligence claim proceed. CrowdStrike’s counsel expects any recovery to be “contractually capped in the single-digit-millions of dollars,” which is less than two percent of the loss (Transportation Today, 2025; Cybersecurity Dive, 2024). Half a billion dollars of loss against a much lower number set years earlier from an estimate.

Separately, the 2024 Change Healthcare attack shows Rung One failing a different way — not through a cap set too low, but through contracts focused on the wrong risk. A ransomware group used compromised credentials to access a Change Healthcare portal. Andrew Witty, CEO of parent company UnitedHealth Group, told the House Energy and Commerce oversight subcommittee that “the portal did not have multifactor authentication,” and that ransomware was deployed nine days after the intruders got in (Cybersecurity Dive, 2024). Change Healthcare touches roughly a third of Americans’ patient records (Senate Finance Committee, 2024). Thousands of providers held signed BAAs with Change Healthcare, governing protected health information and covering requirements for safeguards, permitted uses, and breach notification. The damage that these providers actually absorbed was operational. An American Hospital Association survey of nearly 1,000 hospitals in March 2024 found 94% reported financial impact and 82% reported effects on cash flow (American Hospital Association, 2024). Of the hospitals reporting a cash-flow effect, 60% put the revenue impact at $1 million/day or greater.

Not one of those figures is a breach-notification number. The BAA was a real risk-transfer agreement, correctly executed, addressed to a category of harm (breach notification) that turned out not to be the category that materialized (Holland & Knight, 2024).

Certifications and liability clauses are scoped documents. A company can hold solid certifications and good liability clauses and still absorb losses that fall outside the scope of each. Both scopes are drawn in advance, against an estimate, by people who can not yet know what actual events will impact them.

Why No Vendor’s Insurance Covers Its Whole Customer Base

Before the ladder even reaches the insurer, a structural mismatch is already present. A vendor’s cyber insurance tower (the stack of primary and excess layers that together cap total available coverage) is often sized to the vendor’s own revenue, not to the aggregate exposure it has accepted across its entire customer base.

Brokers argue against that default, which is how you know it is the default. SeedPod tells technology vendors that limits “should be calibrated to the largest contractual indemnification obligation in your client contracts, not your revenue” (SeedPod Cyber, 2025).

Even that advice does not reach the problem. A limit sized to the largest single contract is still not sized to every contract at once. And when a policy’s per-occurrence and aggregate limits are set to the same figure, as they often are (Insureon, 2026), a single compromise that reaches the per-occurrence limit has consumed the whole year’s coverage, leaving nothing for anything else before renewal. The tower covers one bad year of the vendor’s own scattered losses. It may not cover one bad afternoon of simultaneous claims.

The same arithmetic governs the contract side. Liability caps track contract value rather than potential damages: a cap set at the fees paid in the trailing twelve months is the default in SaaS master agreements (Borders Law Group, 2025; GC AI, 2026; CloudNuro, 2025). Customers can negotiate above that default, and data breach is where they usually push. A common fallback position for in-house counsel is a separate, higher cap for security incidents, set at three to five times annual fees. Vendors resist it. What moves them is mainly contract value and the buyer’s documented risk profile (GC AI, 2026). Even a negotiated cap remains a multiple of the fee, not of the customer’s exposure.

This is not a posture individual vendors adopt. It is the structure the products require. A $100,000 agreement cannot usually be priced to absorb $20 million of downstream exposure, and no policy the vendor can afford closes that gap — Rung Two explains why. A vendor that promised more than its revenue could fund would be insolvent on the first claim. That serves no customer.

Vendors admit this when required. CrowdStrike’s risk factors state that “we expect that our insurance coverage will not cover all costs, claims and liabilities actually incurred,” and, of its own contracts, that its limitation-of-liability provisions “may not cover all of our indemnification obligations and they may not fully or effectively protect us from claims” (CrowdStrike Form 10-Q, 2026). A securities filing is the one document where a vendor is obliged to say what its caps and its coverage actually do, and there both are described as possibly insufficient. Customers reading the same company’s compliance page encounter no such qualification.

None of this is a defect on any particular vendor’s balance sheet. It is the arithmetic of the whole category: each customer’s downstream exposure is a large multiple of the fee they pay the vendor, and the insurance tower and contract caps are sized to that fee, not to the multiple.

No amount of negotiating leverage changes which of those two grows faster. A customer who wins a larger cap has moved a liability number, not the actual exposure.

Rung Two: The Insurer’s Promise

Even a vendor that has faithfully bought insurance finds that the policy doesn’t necessarily cover all of the possible losses. When NotPetya hit Merck in 2017 as collateral damage from a Russian action against Ukraine, its insurers invoked a “hostile or warlike action” exclusion, arguing that state-sponsored malware was an act of war. Merck carried $1.75 billion of all-risks property cover that year. By the time the dispute reached the appellate court, most of the thirty-odd insurers had settled and eight were left contesting $699,475,000, just under forty percent of the program (NJ Appellate Division, 2023).

The court held the exclusion inapplicable, reading it to require action by a sovereign engaged in warfare rather than malware attributed to one. The remaining insurers settled in 2024 (Insurance Journal, 2024; Bloomberg Law, 2024). Merck believed that risk had been transferred years earlier. Actually establishing that it had took six years of litigation, deciding a question close enough that a slightly different set of facts could have gone the other way.

A second failure mode catches vendors that did everything else right. The customer contract and the insurance policy are rarely reconciled against each other.

Most cyber policies carry a contractual liability exclusion (Founder Shield, 2026). The exclusion removes coverage for liability the insured assumed by contract, beyond what ordinary law would already impose. An indemnity clause exists to create precisely that liability. The part of the promise the customer negotiated for is therefore the part the insurer may refuse to pay.

P.F. Chang’s hit that exclusion after a payment-card breach. Its insurer did pay, and paid substantially. Federal reimbursed more than $1.7 million for a forensic investigation and for defending lawsuits brought by customers and by an issuing bank (Colin Biggers & Paisley, 2016).

Then the restaurant’s card processor passed along roughly $2 million in MasterCard assessments, owed under the indemnity clause in their contract, and Federal refused those. The court sided with the insurer in P.F. Chang’s China Bistro v. Federal Insurance Co., because the liability existed only through contractual assumption and the policy excluded assumed liability (Honigman; ArentFox Schiff, 2016).

Two nearly identical sums, one paid and one refused. The breach was covered. The processor’s assessment was not.

P.F. Chang’s policy dated to 2013, in a more consolidated, single-agreement generation of cyber forms. Current multi-part policies are commonly drafted so a breach-driven indemnity claim survives the contractual-liability exclusion — some carriers scope the exclusion away from the insuring agreement that would actually respond to a breach claim, others apply it broadly but carve back exactly that fact pattern: disclosure caused by a network-security failure, or an obligation assumed under a privacy policy or non-disclosure agreement (Beazley, 2017; Chubb, 2019; Travelers, 2020). Which mechanism a given policy uses is not visible to the customer negotiating the indemnity. It may not be visible to the vendor’s own contract team either.

The gap is structural rather than careless. A customer contract is negotiated to close a deal, and a broader indemnity costs nothing at signing. The cyber policy is typically bought separately, on its own renewal cycle. A law firm that advises suppliers describes the common response when a large customer asks for an indemnity: “we can agree to that, we have insurance!” (Fieldfisher, 2019). That answer assumes someone has compared the indemnity against the policy. Where nobody has, the first comparison may come after a breach. By then neither document can still be changed.

The fix is cheap. Route material indemnity commitments past whoever owns the cyber policy before signing.

Rung Three: The Reinsurer’s Promise

At the reinsurance layer, the same gap reappears between the estimate a promise was priced against and the loss that eventually arrives. At this rung the gap can stay open for decades before anyone finds it, because the claims that would reveal it have not arrived yet.

Lloyd’s insured companies that used asbestos, under policies written decades earlier and priced for claims expected within a few years. Asbestos disease took decades to appear. Claims were still arriving in the 1980s, in volumes nobody had reserved against. Lloyd’s capital came from some 34,000 private individuals trading with unlimited liability, rather than from shareholders. Thousands of them were ruined, losing £8 billion between 1988 and 1992. (Actuaries Institute, 2015)

Nobody disputed what those policies covered. The wording worked exactly as written. The estimate underneath the wording had been wrong for half a century. Nothing revealed the error until the claims came in.

Rung Four: When the Ladder Runs Out

At the top of the ladder no private party is left to hold the risk. Only the government remains, and it arrives in two forms: a bailout after a private transfer fails, and a public balance sheet that was the only backstop from the start.

AIG in 2008 is the first form. The risk transfer AIG sold was real, but it had been engineered to sit outside the ladder entirely. AIG sold contracts that worked like insurance on bundles of mortgage debt. If the bundles went bad, AIG would pay. Those contracts were called swaps rather than insurance policies, so no insurance regulator required AIG to set money aside against them. A real insurer must hold reserves against what it might owe. AIG held nothing.

The mortgage bundles then failed together, and AIG owed sums for which it had never saved. The government stepped in with what the Treasury puts at roughly $182 billion in combined Treasury and Federal Reserve support (US Treasury; Financial Crisis Inquiry Commission, 2011). The support was repaid and Treasury reported an overall positive return of $22.7 billion on it. The loss landed on the one balance sheet large enough to wait.

The instructive part is not that a policy failed. It is that the promise had been built so that no rung of the ladder applied to it at all. No reserves, no regulator, no reinsurer.

The 2017 WannaCry attack on the UK’s National Health Service (NHS) is the second form. The NHS never had a private ladder to climb. It absorbed roughly £92 million in direct cost, counting lost output and IT remediation. That cost fell entirely on a government operating budget, because the state-run health system carried no cyber-insurance layer at all (Digital Health, 2018). For institutions like the NHS, the top rung is not a bailout after a failed private transfer. It is the only rung there ever was.

Climb the Ladder Anyway

The failures catalogued here are not an argument against buying compliance, insurance, or vendor specialization. The alternative to climbing the ladder is not zero risk. The alternative is making a company’s own balance sheet the only rung. That means less aggregated security expertise, less external audit discipline, and, as the NHS found under WannaCry, sometimes no insurance layer at all. Diversifying who is exposed to a loss is good risk management on its own terms, whether or not it also lowers the odds of the loss.

Specialization is not abstract. A vendor whose product is compliance runs controls that almost no individual customer sustains easily alone:

Security staff whose only job is security
Monitoring that runs continuously rather than when someone remembers
A patch cadence measured against the industry rather than against one team’s backlog
Incident response rehearsed across a whole customer base rather than improvised
An external audit cycle that arrives whether or not it is convenient

Each control lowers the probability of an event and/or the impact of an event. Their effects compound. A company that moves regulated workloads to a specialist is buying a genuinely lower failure rate. It is the most consequential purchase a buyer makes, and no clause on either side of a contract substitutes for it.

The audit apparatus does real work. The relevant comparison is not “audited and safe” versus “audited and still breached.” It is “audited” versus “never audited,” and never audited is far worse. Certifications impose recurring external pressure that most companies would not impose on themselves.

The cases in this piece are tail cases, not the norm. Most BAAs are never tested. Claims are usually paid without a material fight, though not always in full. Sophos’s 2024 healthcare survey found insurers contributing to the ransom payment in 77% of cases, while supplying only 19% of total ransom funding (Sophos, 2024).

Uneventful outcomes leave no public record, so the documented cases skew heavily toward disputes. The ladder mostly works. The interesting question is what happens at the edge, where the caps are set and never validated.

I spent twenty-three years running a HIPAA-compliant infrastructure vendor, on the receiving end of these questions. When customers asked me what their “disaster recovery plan” should be, I would first ask them which specific kinds of events they most want to recover from. Protecting against all of them is either unaffordable or impossible. You pick your battles, and you write down the residual risk you have to accept.

Three Questions, Before You Stop Worrying

Every rung above the first exists because the rung below it occasionally discovers, too late, that its own cap was set too low. A vendor’s compliance posture, your own insurance, and a partner’s indemnification clause each carry that risk in practice. Before relying on any of the three, get a plain-language answer to three questions, in writing, from whoever holds that rung:

What specifically is covered?
What is the cap?
What has to be true for this to actually pay out when it matters?

If those three answers are unavailable or unclear, what is in place may not be a risk transfer. It may only be a document that resembles one.

Then ask a fourth question that the first three deliberately leave out: What is this vendor actually doing to make the event less likely?

The first three answers move only at the margin. Contract caps follow convention and coverage limits follow the structure of the insurance market. The fourth answer varies enormously between vendors, and it is the only one that changes the odds rather than the accounting. A buyer with finite negotiating attention is better off spending it there.

None of this is legal advice, and the answers vary by contract. The questions are the point.

Compliance buys a seat in line, not immunity. Knowing which rung you are actually standing on is the only way to know how far the fall is.

This is not really a story about compliance vendors. It is what happens whenever a fluent phrase gets repeated in place of a claim that nobody re-derives. The question that matters is what the odds actually are. The question that gets answered is whether somebody else’s name is on the paperwork.

References

Primary sources, in order of first appearance.