Systemic Cyber Risk: Cyber Pandemics and Cascading Failure

Most cyber risk registers assume an incident hits one organisation at a time, yet the costliest events of the last decade spread across thousands of organisations at once through shared software, suppliers and infrastructure. Systemic cyber risk is the risk that a single cyber event, malicious or accidental, disrupts many organisations or a whole sector together, with effects that cascade beyond the first victims. "Cyber pandemic" is the popular label for the extreme version: a fast, self-spreading or widely shared failure with economy-wide consequences. This guide explains how systemic events propagate, what NotPetya, WannaCry and the July 2024 CrowdStrike outage showed, how insurers model catastrophe and exclude state-backed attacks, what regulators expect, and how to plan scenarios. It is written for risk owners, CISOs and resilience leads; supplier dependency on its own is covered in the Third-Party Concentration Risk Guide.

Key takeaways

Systemic means correlated. The defining feature is that many organisations fail at the same time for the same reason, so mutual aid, suppliers and insurers are stretched exactly when you need them.
Accidents count. The CrowdStrike content update of 19 July 2024 affected about 8.5 million Windows devices, by Microsoft's estimate, without any attacker involved; scenario libraries must include faulty updates and provider outages.
Insurance will not absorb all of it. Lloyd's has required standalone cyber policies to exclude state-backed cyber-attacks that significantly impair a state since 31 March 2023, and its own systemic scenario puts potential losses far above market premium.
Regulators now treat it as financial stability risk. The ESRB, the Bank of England's Financial Policy Committee and DORA's critical third-party regime all address cyber events that could spread across the financial system.
Plan for operating while the shared thing is down. The practical response is impact tolerances, manual workarounds, recovery that does not depend on the failed component, and exercises that assume your peers are down too.

What systemic cyber risk and "cyber pandemic" mean

The European Systemic Risk Board's February 2020 report Systemic cyber risk uses the EU definition of systemic risk from Regulation (EU) No 1092/2010: a risk of disruption in the financial system with the potential to have serious negative consequences. The ESRB describes how a cyber incident becomes systemic through transmission channels (operational, confidence and financial) and through amplifiers, which it splits into system amplifiers that worsen any operational disruption and cyber-specific amplifiers that come from the nature of cyber incidents.

"Cyber pandemic" is not a regulatory term. It is used in commentary and exercises for a scenario where malicious code, or a defect, spreads like a contagion across interconnected systems faster than organisations can respond. The analogy is useful in one respect: like public health, the outcome depends on shared hygiene (patching, segmentation, safe deployment) more than on any one organisation's defences.

Term	Meaning	Example
Systemic cyber risk	One event disrupts many organisations or a sector, with knock-on effects	Faulty security update crashing millions of hosts
Cyber catastrophe	Insurance view: an event with aggregated losses across many policies	Lloyd's payments system scenario
Cascading failure	Failure in one system triggers failures in dependent systems	Clearing house down, so pharmacies cannot process claims
Concentration risk	Many depend on one supplier or technology; a cause of systemic risk	Single cloud region, single EDR vendor
Systemic failure	Breakdown of a whole system rather than one component	Sector-wide payment outage
Service or operational disruption	Loss of ability to deliver a service; the observable effect	Flights grounded, hospitals on paper

How cyber events cascade

Common software: one product or update channel reaches thousands of customers simultaneously. A malicious update (the SolarWinds pattern) or a defective one (CrowdStrike) has the same reach.
Self-propagating malware: worms that spread over the network using exploits or harvested credentials move faster than human response. See the Computer Worms Guide.
Shared infrastructure: cloud regions, DNS, content delivery and identity providers sit beneath many services; an outage there removes several "independent" options at once.
Sector utilities: clearing houses, payment schemes, claims processors and logistics platforms connect many firms; one compromise halts the sector's flow.
Collateral damage: attacks aimed at one country or sector spill worldwide through global networks of multinational companies.
Confidence: even where systems recover, loss of trust (for example in a payment system) can change behaviour across a market.

Historic cascading incidents

Event	What happened	Systemic lesson
WannaCry, 12 May 2017	Self-spreading ransomware. The UK National Audit Office found at least 81 of 236 NHS trusts and 603 primary care and other NHS organisations infected, with 6,912 recorded cancelled appointments and an estimated 19,000 or more in total	Unpatched, unsegmented estates let a worm hit a whole health system in a day; NHS Digital told the NAO that managing internet-facing firewalls would have guarded organisations against infection
NotPetya, June 2017	Destructive malware disguised as ransomware, attributed by the UK government on 15 February 2018 to the Russian military. It targeted Ukrainian financial, energy and government sectors and spread indiscriminately. Maersk reported costs of 200 to 300 million US dollars	Collateral damage from a state operation reached multinationals worldwide; it also became the reference case for war exclusion disputes
Change Healthcare, February 2024	Stolen credentials on a Citrix portal without MFA led to ransomware; pharmacies, hospitals and practices across the US could not submit claims or check coverage for weeks	A single claims intermediary was a sector-wide single point of failure
CrowdStrike, 19 July 2024	A Falcon Rapid Response Content update for Windows released at 04:09 UTC and reverted at 05:27 UTC crashed hosts that were online in that window; Microsoft estimated 8.5 million Windows devices, under one percent of all Windows machines	No attacker needed; a privileged kernel-level component deployed everywhere at once is a systemic dependency

Insurance: catastrophe modelling and war exclusions

Insurers worry about systemic cyber risk because correlated losses can exceed the capital held against them. Lloyd's published a systemic risk scenario with the Cambridge Centre for Risk Studies on 18 October 2023: a cyber attack on a major payments system. It put the central estimate of global economic loss at 3.5 trillion US dollars over five years, within a range of 2.2 to 16 trillion depending on severity, against cyber insurance gross written premium of just over 9 billion US dollars in the prior year. The point for buyers is that most of such a loss would be uninsured.

Lloyd's Market Bulletin Y5381 (16 August 2022) requires standalone cyber-attack policies to include a clause excluding liability for losses from state-backed cyber-attacks, from 31 March 2023 at inception or renewal. The minimum requirements are that the clause excludes war (where there is no separate war exclusion), excludes state-backed attacks that significantly impair a state's ability to function or its security capabilities, states clearly whether it excludes systems outside an affected state, sets out a robust basis for attribution, and defines key terms clearly.

Read your wording: find the war, state-backed and infrastructure exclusions, how attribution is decided and who bears the burden of proof.
Check aggregation: event limits and how many claims one systemic event counts as.
Check non-malicious cover: whether "system failure" or dependent business interruption from a provider outage is covered at all, and the waiting period.
Model the uninsured part: treat insurance as one layer and size retained loss for a multi-week sector outage. See the Cyber Insurance Guide and the Cyber Risk Quantification Guide.

What regulators expect

Body or rule	Position on systemic cyber risk
European Systemic Risk Board	The 2020 Systemic cyber risk report frames cyber incidents as a potential source of systemic risk to the financial system, transmitted through operational, confidence and financial channels
Bank of England Financial Policy Committee	The November 2024 Financial Stability Report notes heightened cyber-attack risk from geopolitical tension, cyber-attacks among the most cited risks in its Systemic Risk Survey, cyber stress testing as a key FPC tool, and welcomes the critical third parties regime
EU DORA (Regulation (EU) 2022/2554)	ICT risk management, incident reporting, resilience testing and an oversight framework for critical ICT third-party providers. See the DORA Guide and the DORA Critical ICT Third-Party Provider Oversight Guide
UK operational resilience rules	Firms set impact tolerances for important business services and must be able to stay within them in severe but plausible scenarios. See the UK Financial Operational Resilience Guide

Outside finance, critical infrastructure rules such as NIS2 and the EU Critical Entities Resilience Directive push in the same direction: understand dependencies and plan for disruption that starts elsewhere. See the EU Critical Entities Resilience Directive Guide.

Scenario planning for systemic events

Ordinary scenarios ask "what if we are breached". Systemic scenarios ask "what if a component everyone uses fails, and nobody can help us quickly". Build three to five of them into your Cyber Risk Scenario Library.

Map important services to shared dependencies: for each important business service, list the software with privileged or kernel access deployed everywhere (EDR, patch management, remote management), identity providers, cloud regions, payment and sector utilities, and the people or firms who can restore them.
Write the scenarios: for example, a faulty update crashes all Windows endpoints and servers; the identity provider is unavailable for 48 hours; a sector utility is offline for three weeks after ransomware; a worm spreads through the internal network with harvested admin credentials.
Add the systemic conditions: peers are affected at the same time, the supplier's support is overwhelmed, incident response retainers are oversubscribed, insurers dispute attribution, staff cannot reach systems remotely.
Set impact tolerances (maximum tolerable disruption) for each service and test whether manual workarounds, alternative channels or degraded modes keep you within them. See the Business Impact Analysis Template.
Exercise: run tabletop exercises with the executive team and key suppliers; include a recovery step where you rebuild thousands of hosts by hand. See the Tabletop Exercise Scenario Pack.
Fund the gaps and record residual risk against your risk appetite; revisit after any major industry incident.

Controls that reduce systemic exposure

Staged deployment for privileged agents: where vendors allow it, put security and management agent updates into rings (test, early, broad) rather than everyone at once.
Recovery independence: keep offline or immutable backups, break-glass accounts and recovery tooling that do not depend on the failed identity provider, EDR or management plane. See the Minimum Viable Company Recovery Guide.
Segmentation and patching of internet-facing and lateral protocols, which limit worm-style spread.
Diversity where it is cheap: a second communications channel, a secondary DNS provider, an alternative payment route.
Machine identity hygiene: worms and supply chain intrusions spread with harvested service account and admin credentials; tiering and vaulting non-human identities limits the blast radius. See the Cyber Resilience Guide.

Detection and measurement

Dependency coverage: percentage of important business services with mapped shared dependencies and named recovery owners.
Tolerance tested: share of important services exercised against a systemic scenario in the last 12 months, and whether they stayed within tolerance.
Recovery time at scale: measured time to rebuild or restore a defined percentage of endpoints and servers without the primary management tooling.
Update ring compliance: share of privileged agents (EDR, RMM, patching) on staged rather than immediate update policies.
Uninsured exposure: modelled retained loss for the worst systemic scenario versus risk appetite.

Watch provider status pages, sector ISAC alerts and national CERT advisories as early indicators; systemic events are usually visible across the sector before they reach you.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.OC-04 critical objectives and services, GV.RM-03 cyber risk in enterprise risk management, GV.SC-07 supplier risk, ID.RA-05 inherent risk, ID.IM-04 plans, RC.RP-01 recovery execution	Understanding dependencies, planning and recovery
NIST SP 800-53 Rev. 5	CP-2 Contingency Plan, RA-3 Risk Assessment, RA-3(1) Supply Chain Risk Assessment, SR-3 Supply Chain Controls and Processes, PM-30 Supply Chain Risk Management Strategy	Contingency and supply chain controls
ISO/IEC 27001:2022 Annex A	A.5.29 Information security during disruption, A.5.30 ICT readiness for business continuity, A.5.19 to A.5.22 supplier relationships	Continuity and supplier controls
ISO 22301	Business impact analysis and continuity strategies	Impact tolerances and workarounds; see the ISO 22301 Business Continuity Guide

Lessons from incidents

The Change Healthcare breach is the clearest live example of a cascade from one organisation's control gap. Initial access on 12 February 2024 came through a stolen credential on a Citrix remote-access portal without multi-factor authentication; ransomware followed on 21 February. Change Healthcare took systems offline to contain it, and pharmacies, hospitals and physician practices across the US could not submit claims or check coverage for weeks, many facing serious cash-flow problems. Three lessons carry over to any sector:

Know your intermediaries: the providers hurt most had no direct relationship with the attacker; their dependency was a claims clearing service they rarely thought about.
Pre-arrange the alternative: a second clearing route or a manual process agreed in advance is far quicker to switch on than one negotiated during a sector-wide outage, when every peer is asking the same suppliers.
Baseline controls at the hub matter to everyone: one missing MFA requirement at a sector utility became a sector-wide outage, which is why regulators now look at critical providers directly.

Common failure patterns

Only malicious scenarios: registers that model attackers but not faulty updates or provider outages missed the largest IT outage of 2024.
Assuming help will arrive: plans that rely on the vendor, the MSP or the IR retainer ignore that everyone else is calling them too.
Recovery that depends on the failed thing: BitLocker keys, admin passwords or runbooks stored only in systems that are down.
Treating insurance as the plan: state-backed exclusions, aggregation limits and waiting periods leave large retained losses.
Mapping suppliers but not their suppliers: the clearing house, cloud region or software component shared by your "diverse" vendors is the real single point of failure.

Practitioner checklist

Add at least three systemic scenarios (faulty update, identity provider outage, sector utility outage) to the risk register.
Map important business services to shared software, infrastructure and sector utilities.
Set and test impact tolerances assuming peers and suppliers are also affected.
Move privileged agents to staged update policies where vendors support them.
Keep recovery keys, break-glass credentials and runbooks outside the systems they recover.
Review insurance wording for war, state-backed, system failure and dependent business interruption terms.
Quantify uninsured systemic loss and report it to the board against risk appetite.
Run a yearly tabletop with suppliers on a multi-week systemic outage.

Systemic Cyber Risk: How Cascading Failures Spread and How to Plan