Denial Of Service Attack
Written by Justin Goodman, CIC, CISC, CLCS, CEO and Co-Founder, Total CSR
Published: September 10, 2026 · Last reviewed: September 10, 2026
In plain language: A denial of service attack floods a company's website or network with fake traffic until real customers and employees cannot get through. The business effectively goes dark online, even though no data was stolen and no ransom demand was made.
Technical definition: A denial of service attack is a cyberattack that exhausts a target system's bandwidth, processing capacity, or connections, rendering it unavailable to authorized users. Distributed denial of service (DDoS) variants launch the flood from many compromised machines at once. Cyber liability policies typically list this as a covered "network security event" or "security failure" trigger.
Denial of Service Attack at a Glance
| Attribute | Detail |
|---|---|
| Also known as | DoS attack, DDoS attack, Distributed Denial of Service |
| Category | Cyber liability peril |
| Lines of business | Cyber Liability, Technology E&O, Commercial Property |
| Industries most affected | Retail, financial services, healthcare, e-commerce, technology |
| Related forms or endorsements | ISO CY 00 01 (Cyber Coverage Suite) |
| Who bears the risk | The insured business; extends to vendors and cloud hosts via contingent coverage |
| Common solution | Cyber liability policy with network interruption and forensic response coverage |
| Also interacts with | Business interruption insurance, contingent business interruption, ransomware coverage |
Key Takeaways
- A denial of service attack overwhelms a network or website with traffic so legitimate users cannot connect, causing downtime rather than data theft.
- Agencies must confirm the client's cyber policy covers network interruption income loss, not just data breach notification costs, since many small business cyber packages skip that coverage.
- The most common misunderstanding is assuming a general liability or property policy responds to a DoS attack; most exclude cyber-related loss entirely.
- A quick win for agencies is verifying whether the cyber form includes contingent business interruption, since many DoS attacks target a client's cloud host or payment processor rather than the client directly.
What Is Denial of Service Attack in Insurance?
A denial of service attack is a deliberate cyberattack designed to make a website, application, or network unavailable by overwhelming it with traffic or requests. Attackers use botnets of compromised devices to generate the flood in a distributed denial of service, or DDoS, making the traffic source harder to block. Unlike a data breach, a DoS attack does not typically exfiltrate customer information. Instead, it causes lost sales, idle employees, and reputational damage during the outage.
Carriers underwrite this peril because interruption losses can rival or exceed breach notification costs, especially for e-commerce and payment-dependent businesses. An hour of downtime for a retailer during a peak sales period can cost more than a year of cyber premium. Insurers protect against this by pricing network interruption sublimits, waiting periods, and forensic response costs into the cyber form.
Consider an online furniture retailer hit by a DDoS attack during a holiday sale. The attack knocks the site offline for six hours, blocking roughly $180,000 in expected sales and forcing the retailer to pay a mitigation vendor $15,000 to reroute traffic. A cyber policy with network interruption coverage responds to both the lost income and the mitigation expense, subject to the policy's waiting period and sublimit.
How Does Denial of Service Attack Work?
- The flood. Attackers direct massive volumes of traffic or malformed requests at the target server, often using a botnet of hijacked devices spread across many locations.
- The outage. The target system exhausts its bandwidth or processing capacity, and legitimate users receive timeouts or error pages instead of the website or application.
- The detection. The company's IT team or managed security provider identifies abnormal traffic patterns and confirms an active DoS event rather than routine congestion.
- The mitigation. The insured engages a mitigation vendor, often through the carrier's breach response panel, to filter malicious traffic and restore service.
- The claim. The insured documents lost income, extra expense, and forensic costs, then submits the claim under the cyber policy's network interruption and incident response provisions.
Real Claim Examples Involving Denial of Service Attack
Payment processor outage during peak retail season
A mid-size apparel retailer relied on a third-party payment gateway that suffered a DDoS attack during a major promotional weekend. The retailer's own site stayed online, but customers could not complete checkout for nine hours. Because the retailer's cyber policy included contingent business interruption coverage for critical vendors, the carrier paid the lost profit tied to the outage after applying the policy's waiting period.
Extortion-linked attack on a regional bank's online portal
A community bank received a ransom demand threatening a sustained DDoS attack against its online banking portal unless payment was made in cryptocurrency. The bank refused to pay and instead activated its incident response team, incurring forensic and mitigation costs during a partial outage. The cyber policy's cyber extortion and network interruption insuring agreements both responded, though the bank's deductible applied separately to each.
Healthcare scheduling system taken offline
A multi-location medical group's patient scheduling platform was knocked offline by a DDoS attack for two full business days, forcing staff to revert to phone-based scheduling and delaying non-urgent appointments. The group's cyber policy paid for extra expense related to temporary staffing and manual processes, but the claim revealed the policy's waiting period exceeded the outage length by several hours, reducing the payable loss.
Denial of Service Attack vs. Ransomware: What Is the Difference?
A denial of service attack disrupts availability by flooding a system with traffic, while ransomware encrypts or locks data and demands payment for its release. Both fall under cyber liability coverage, but they trigger different insuring agreements and carry different negotiation dynamics.
| Comparison area | Denial of Service Attack | Ransomware |
|---|---|---|
| Primary use case | Disrupting access to a website, application, or network | Extorting payment by encrypting or threatening to leak data |
| Coverage / concept type | Network interruption, extra expense | Cyber extortion, data restoration, business interruption |
| Typical exclusions | Acts of war, unpatched known vulnerabilities | Failure to maintain backups, unpatched known vulnerabilities |
| Who is most affected by errors | E-commerce and transaction-dependent businesses | Any business holding sensitive data or critical systems |
| Common mistakes | Assuming property insurance covers the downtime | Assuming general liability responds to extortion demands |
What Are the Most Common Mistakes With Denial of Service Attack?
- Agencies quote a cyber policy without confirming a network interruption sublimit exists, leaving a client with data breach coverage but no protection for downtime losses.
- Clients assume commercial property business interruption coverage applies, but most property forms require direct physical loss and exclude cyber-related outages entirely.
- Agents overlook contingent business interruption coverage, which matters most for clients dependent on cloud hosts, payment processors, or SaaS vendors that are the actual attack target.
- Waiting periods get ignored during the sale, and clients discover during a claim that a six-hour outage falls entirely within an eight-hour waiting period, producing no payout.
- Documentation of lost income during the outage is often incomplete, since businesses rarely track hourly revenue precisely enough to satisfy a carrier's proof-of-loss requirements.
How to Explain Denial of Service Attack to a Client
Explaining Denial of Service Attack to a personal lines client
A denial of service attack usually targets businesses and large websites rather than individual home networks, so this typically will not affect your personal devices directly. If you shop or bank online and a retailer's site goes down, that's the retailer's problem to insure, not yours. Your personal cyber endorsement, if you have one, focuses more on identity theft and online fraud than this type of attack.
Explaining Denial of Service Attack to a small business owner
A denial of service attack floods your website or online systems with fake traffic until real customers can't get through, and it can shut down sales for hours or days. Cyber insurance can cover the income you lose during that outage and the cost of a specialist to stop the attack. We need to check whether your policy has a waiting period, because a short outage might fall under that threshold and pay nothing.
Explaining Denial of Service Attack to a CFO or risk manager
A denial of service attack creates a business interruption exposure inside your cyber program, distinct from the data breach liability most executives focus on first. The key numbers to model are your waiting period, your network interruption sublimit, and whether contingent business interruption extends to your critical vendors like payment processors or cloud hosts. I'd recommend we run a loss scenario together using your actual hourly revenue figures so we size the sublimit correctly.
Frequently Asked Questions About Denial of Service Attack
Does general liability insurance cover a denial of service attack?
General liability insurance does not cover a denial of service attack because it responds to bodily injury and property damage from third-party claims, not network downtime or lost income. Most GL forms include a cyber exclusion that removes any ambiguity. A cyber liability policy is the correct product for this exposure.
Will cyber insurance pay for lost income during a DDoS attack?
Cyber insurance can pay for lost income during a DDoS attack if the policy includes a network interruption or business income insuring agreement, subject to a waiting period and sublimit. Not every cyber form includes this coverage automatically, particularly cheaper small business packages. Agencies should confirm this coverage exists before binding, especially for e-commerce clients.
What is a waiting period in a cyber policy and why does it matter for DoS attacks?
A waiting period is the number of hours an outage must last before business interruption coverage begins to pay, similar to a time deductible. Many DoS attacks resolve within a few hours through mitigation, meaning a short waiting period of four to six hours matters far more than a low sublimit. Agencies should negotiate the shortest waiting period the carrier will offer for clients with revenue-dependent websites.
Can a denial of service attack trigger coverage even if the client's own systems were not attacked?
A denial of service attack can trigger coverage even when a third-party vendor was the actual target, if the policy includes contingent business interruption coverage for dependent business partners. Total CSR's training work with agency CSRs consistently finds that this vendor-dependency gap is the single most misunderstood coverage feature in cyber policies, because agents describe the peril but skip the vendor angle when explaining coverage to clients. Confirming named or unnamed dependent business coverage is critical for any client relying on cloud hosting or payment processing.
Is a denial of service attack considered an act of war and excluded from coverage?
A denial of service attack is generally not treated as an act of war unless clear evidence ties it to a nation-state military action, and most cyber war exclusions require that specific attribution. Carriers have faced litigation over broadly worded war exclusions following high-profile nation-state cyberattacks. Agencies should review the specific war exclusion language in each cyber form rather than assuming standard treatment.
Do carriers require specific security controls before covering DoS attack risk?
Carriers increasingly require multi-factor authentication, endpoint detection, and incident response plans as underwriting conditions before binding cyber coverage, and some specifically ask about DDoS mitigation services or content delivery network protections. Failing to maintain these controls after binding can jeopardize claims under a warranty or conditions precedent clause. Agencies should document the client's actual security posture accurately on the application.
Related Insurance Terms
- Business Interruption Insurance: Coverage that reimburses lost income and continuing expenses when a covered peril halts normal operations, forming the model that cyber network interruption coverage adapts for digital outages like DoS attacks.
- Contingent Business Interruption: Coverage for lost income caused by a disruption to a supplier, vendor, or partner rather than the insured directly, which is often the actual trigger when a DoS attack hits a cloud host or payment processor.
- Ransomware: A malware-based extortion attack that encrypts data and demands payment, distinct from a DoS attack but covered under the same cyber liability policy structure.
- Network Security Liability: A cyber insuring agreement covering the insured's legal liability to third parties for a failure of network security, which can overlap with DoS attack claims when customers or partners suffer losses from the outage.
- Data Breach: Unauthorized access to or theft of sensitive information, which differs from a DoS attack because availability is disrupted rather than confidentiality being compromised.
- Cyber Extortion: Coverage responding to ransom demands tied to threatened or actual cyberattacks, frequently paired with DoS attacks when criminals threaten sustained outages unless paid.
Sources and References
- CISA. Understanding Denial-of-Service Attacks.
- International Risk Management Institute. Cyber and Privacy Insurance.
About the Author
Justin Goodman, CIC, CCIP, CISC, CLCS, CRIS, PCIA, QCLS, MFHR CEO and Co-Founder, Total CSR, Inc.
Justin Goodman is a third-generation insurance broker with over two decades in agency operations. He has trained more than 100,000 CSRs, account managers, and producers in commercial and personal lines coverage, from workers' compensation to construction risk. He was named 2024 Insurance Journal Agent of the Year and one of the nation's top five construction insurance experts by Risk & Insurance. He is the author of Retain, which applies cognitive science research on memory and knowledge transfer to insurance training, and speaks nationally on how agencies build durable technical expertise in their teams.