CyberCube Launches Cyber Aggregation Event Response Service in response to Microsoft outage
November 13, 2026
Following the onset of the global Microsoft outage, which began on November 12 and has impacted more than 75 countries, CyberCube has activated the initial procedures of its Cyber Aggregation Event Response Service (CAERS). CAERS provides up-to-date intelligence on major cyber catastrophes worldwide as they unfold to ensure CyberCube clients have the most relevant information regarding significant aggregation events. CyberCube is creating a Security Incident Report (SIR) for clients by end of day Eastern Time and will issue follow-on guidance as appropriate.
William Altman, Director, Threat Intelligence Services, CyberCube, said: “This is a significant outage, and it has already lasted longer than the waiting periods in many cyber policies. We’re watching closely to see how long the disruption lasts, and we are advising clients to use our technology dependency mapping tools and portfolio risk modeling solutions to identify exposure and estimate potential losses.”
Users lost access to their Exchange Online mailboxes on Thursday, November 12, and the disruption spread to other Microsoft 365 services that rely on Exchange. So far Microsoft has indicated no evidence that the outage resulted from a cyberattack, although a full post-incident report (PIR) is not yet available. While this event is widespread and still ongoing, the services disrupted are mostly impacting business productivity as opposed to critical revenue-generating workflows. This is an important distinction when considering insurance impacts: annoyance versus material financial disruption.
By third-party measures, Exchange traffic was depressed for about 18 hours. On Microsoft’s own incident clock, the outage has now lasted over 24 hours. That is long enough to matter for cyber insurance. Cover for non-malicious outages at a technology provider, known as contingent systems failure, typically has waiting periods of eight to 12 hours.
Key considerations are how long the disruption continues and whether businesses experience material disruption to operations or merely an inconvenience as a result. These considerations are related: the longer disruption continues, the more potential for what began as an inconvenience to directly inhibit revenue-generating business operations. The companies which are potentially most exposed are those relying on email communications for their revenue – such as those that take orders, confirm trades or close deals by email.
The outage also demonstrates how much insurers’ exposure depends on shared technology providers. Users were impacted worldwide and across sectors. For insurers, the question is not where their policyholders are or what industry they’re in, but how many of them rely on Exchange Online and Microsoft 365.
Jon Laux, CyberCube’s VP of Products and Analytics, said: “This is a global, non-malicious event affecting Microsoft 365 users in more than 75 countries. Disruption is still ongoing, which takes it beyond typical business interruption waiting periods. In most cases, though, users are seeing degraded service rather than a full outage. Microsoft 365 covers many services, but in practice the impact has centered on Exchange Online email, and to a lesser degree on Teams and Copilot. Our catastrophe model, Portfolio Manager, has a catalog that contains scenarios that closely resemble this one. This gives (re)insurers a useful reference point for how a single point of failure event like this can play out.
“For (re)insurers, this is a contingent system failure event. At this stage, we expect insured losses to be low and claims activity to be limited. We have seen reports of delays, but no high-profile examples of companies being critically affected. However, the event is still unfolding, and claims volumes only tend to rise over time, so we will continue to monitor developments closely.”
Media contact: Yvette Essen, Head of Communications & Market Engagement, yvettee@cybcube.com