Category: Cyber Threats & Attacks

Denial-of-Service Attack

Also known as: DoS, Denial of Service, DoS attack

Simply put

A denial-of-service attack is a deliberate attempt to make a website, system, or network unavailable to the people who are supposed to use it. Attackers commonly do this by flooding the target with so many requests or so much traffic that it becomes overloaded and stops responding. The result is disruption of access rather than theft of data.

Formal definition

A denial-of-service (DoS) attack is a malicious action that prevents authorized users from accessing information systems, devices, or network resources, or that delays time-critical operations. It is typically accomplished by flooding a targeted machine or resource with superfluous or excessive requests in an attempt to overload systems, exhaust capacity, and disrupt normal operations, thereby rendering the service unusable. As an availability-impacting threat, DoS is distinct from confidentiality- or integrity-focused attacks; note that from an insurance perspective, whether resulting losses (such as business interruption or extra expense) are covered depends on the specific policy wording, applicable waiting periods, sublimits, and exclusions, and is not addressed by this definition. This entry describes single-source DoS; distributed denial-of-service (DDoS), which uses multiple coordinated sources, is a related but separate concept.

Why it matters

A denial-of-service attack targets availability rather than confidentiality or integrity, which means its primary business impact is disruption of access. For organizations that depend on customer-facing websites, transaction platforms, or time-critical operations, even a temporary loss of availability can translate into lost revenue, contractual penalties, reputational harm, and cascading operational delays. Because DoS attacks aim to make services unusable rather than to steal data, they may fall outside the scope of controls and coverages designed around data breach, which is why they warrant distinct attention in both resilience planning and insurance review.

From a risk-transfer perspective, losses arising from a DoS attack, such as business interruption or extra expense, may potentially be addressed under a cyber policy, but whether they are covered depends entirely on the specific policy wording. In many policies, business interruption coverage is subject to a waiting period (an hourly threshold that must be exceeded before coverage responds), sublimits, retentions, and exclusions. A short-duration DoS event may fail to exceed a waiting period, and certain events may be affected by exclusions such as infrastructure or war exclusions. Organizations should not assume that a disruption is automatically covered, and coverage analysis is a separate exercise from the technical description of the attack itself.

Critically, insurance does not reduce the likelihood of a DoS attack occurring, nor does it restore availability during an event. Risk transfer through insurance is complementary to, not a substitute for, mitigation measures and resilience planning. An organization's ability to absorb, respond to, and recover from a DoS event depends on its technical defenses, incident response readiness, and business continuity arrangements, which operate independently of any policy that may indemnify a portion of the resulting financial loss.

Who it's relevant to

Risk Managers

Risk managers must recognize that DoS exposure is an availability risk that may not be captured by controls or coverages oriented toward data confidentiality. They should evaluate the organization's dependence on always-available services and consider how a disruption maps to potential business interruption or extra expense, while understanding that insurance addresses financial loss and does not prevent or shorten an outage.

Insurance Brokers and Underwriters

Brokers and underwriters need to assess how a given cyber form responds to availability-impacting events. Whether DoS-related losses are covered depends on the specific policy wording, including any waiting period, sublimits, retentions, and applicable exclusions. Short-duration events may fail to exceed a waiting period, and clear articulation of these conditions helps set accurate expectations for the insured.

Chief Information Security Officers

CISOs are responsible for the technical mitigations that reduce the likelihood and impact of DoS and DDoS events, and for distinguishing availability threats from confidentiality- or integrity-focused attacks. They should ensure that defensive measures and detection capabilities are aligned to resource-exhaustion and flooding scenarios, recognizing that risk transfer does not substitute for these controls.

Resilience and Business Continuity Planners

Because a DoS attack can delay time-critical operations or render services unavailable, continuity planners should account for availability loss in recovery planning, including recovery time objectives for affected services. Resilience arrangements determine how quickly access can be restored during an event, a capability that operates independently of any insurance that may indemnify a portion of the financial loss.

Legal and Compliance Professionals

Legal and compliance teams should note that DoS is defined consistently across major sources as an availability-impacting attack rather than a data breach, which can affect how notification obligations and contractual availability commitments apply. They should also be aware that coverage determinations turn on specific policy language and jurisdiction, and are distinct from the technical characterization of the incident.

Inside DoS

Volumetric attack

A method that seeks to overwhelm the target's available bandwidth by flooding it with high volumes of traffic, exhausting the network capacity between the target and the wider internet.

Protocol (state-exhaustion) attack

A method that consumes finite resources in servers or intermediary devices such as firewalls and load balancers by exploiting weaknesses in network protocol handling, rather than raw bandwidth.

Application-layer attack

A method that targets specific applications or services with requests that appear legitimate, exhausting server-side processing resources; these can be harder to distinguish from genuine traffic.

Distributed denial-of-service (DDoS)

A variant in which the attack traffic originates from many distributed sources, often a botnet of compromised devices, making it harder to block by source and amplifying volume.

Business interruption impact

The operational consequence most relevant to insurance: loss of availability of systems or services that may cause lost income or extra expense. Whether this is covered typically depends on first-party business interruption wording, any applicable waiting period, and the specific policy terms.

Waiting period / time retention

A common feature of first-party cyber business interruption coverage that functions like a time-based deductible, requiring the outage to persist beyond a defined duration before loss becomes recoverable, subject to the specific policy wording.

Resilience and mitigation controls

Security and continuity measures (for example traffic filtering, rate limiting, upstream scrubbing services, and capacity planning) that reduce the likelihood or impact of an attack. These are security and resilience concepts, distinct from insurance coverage terms.

Common questions

Answers to the questions practitioners most commonly ask about DoS.

Does a denial-of-service attack automatically trigger business interruption coverage under a cyber policy?

Not automatically. DoS-related business interruption is a first-party coverage that typically depends on whether the policy's insuring agreement is triggered by the specific type of interruption, whether a waiting period (also called a time retention) has been exceeded, and whether applicable exclusions apply. Many cyber policies impose a waiting period measured in hours before business interruption loss begins to accrue, so a short-lived DoS event may fall entirely within that period and produce no recoverable loss. Whether any given attack is covered is subject to the specific policy wording, endorsements, and conditions.

Is having DoS mitigation controls in place the same as being insured against a DoS attack?

No. Mitigation controls (such as traffic filtering, upstream scrubbing, or capacity provisioning) are risk mitigation measures intended to reduce the likelihood or severity of an incident. Insurance is a risk transfer mechanism that addresses financial loss after an incident occurs; it does not reduce the likelihood of an attack and does not by itself constitute resilience. The two are complementary rather than interchangeable, and some insurers treat the presence and adequacy of mitigation controls as relevant to underwriting or to how certain exclusions and conditions apply.

How does a policy's waiting period affect a claim arising from a DoS attack?

A waiting period (time retention) functions as a threshold that must be exceeded before first-party business interruption loss begins to accrue under many cyber policies. For a DoS event, this means the duration of the disruption relative to the stated waiting period can determine whether any loss is recoverable at all. The exact measurement method, how it interacts with any monetary retention, and whether restoration or extra expense costs are treated differently are all governed by the specific policy wording.

How should recovery objectives be considered alongside DoS-related coverage?

Recovery objectives are resilience metrics, distinct from coverage terms. A recovery time objective (RTO) expresses the targeted duration to restore a service, while a recovery point objective (RPO) concerns tolerable data loss and is less directly relevant to a service-availability event like DoS. These metrics inform continuity and disaster recovery planning but do not determine coverage; a policy's waiting period and sublimits operate independently. Aligning your understood RTO with the policy's waiting period can help clarify the gap between when service is expected to be restored and when insurable loss would begin to accrue.

Might a DoS claim be affected by infrastructure or war-related exclusions?

Potentially, depending on wording. Some cyber policies contain exclusions relating to failure of infrastructure (for example, disruptions attributed to external utility, internet, or upstream provider outages) and exclusions relating to war or hostile action, which have been the subject of evolving language across insurer forms. Whether a particular DoS event falls within or outside such an exclusion depends on the attack's characteristics, how the exclusion is drafted, and the applicable jurisdiction. This is an area of genuine variation and disagreement among insurers, so the specific form should be reviewed.

What documentation supports a first-party claim following a DoS attack?

While requirements vary by policy, insurers commonly look for evidence establishing the fact and timing of the disruption, its duration relative to any waiting period, and the financial impact claimed. This can include incident logs and timelines, records substantiating lost revenue or extra expense, and documentation of restoration or mitigation costs. Because notice provisions and conditions precedent are typically part of the policy, timely reporting and cooperation are often conditions of coverage. The precise proof-of-loss requirements are governed by the specific policy wording and should be confirmed with the insurer or broker.

Common misconceptions

A denial-of-service attack is a data breach, so it triggers privacy liability coverage.

A denial-of-service attack primarily affects availability rather than confidentiality, and typically does not by itself involve unauthorized access to or exfiltration of personal data. Third-party privacy liability coverage responds to claims arising from compromised data; availability loss is more commonly addressed, if at all, under first-party business interruption wording. Whether either applies depends on the specific policy terms, endorsements, and exclusions.

Holding cyber insurance means denial-of-service downtime is fully and automatically covered.

Insurance is a risk-transfer mechanism and does not reduce the likelihood of an attack or restore availability. Recovery under a policy is conditional on the wording, applicable sublimits and retentions, any waiting period before business interruption loss accrues, and exclusions (such as infrastructure or war-related exclusions). Coverage should not be assumed to be complete or automatic.

A DDoS attack is a fundamentally different threat requiring separate coverage from a single-source DoS.

A distributed denial-of-service is a variant of a denial-of-service attack that uses many distributed sources; it changes the technical difficulty of defense rather than the basic nature of the event. Whether policy wording treats them the same is a matter of the specific definitions used in the form and should be confirmed against the wording.

Best practices

Read the first-party business interruption wording carefully to confirm whether availability loss from a denial-of-service event is within scope, and identify any waiting period, sublimit, or retention that applies.

Do not assume denial-of-service downtime triggers third-party privacy liability coverage; clarify with your broker which insuring agreements respond to availability loss versus data compromise.

Check policy exclusions that may affect denial-of-service claims, such as infrastructure, war, or failure-to-maintain-standards exclusions, and confirm how the form defines the triggering event.

Treat insurance as risk transfer, not risk reduction, and pair it with mitigation controls such as traffic filtering, rate limiting, upstream scrubbing, and capacity planning to lower likelihood and impact.

Align recovery objectives (RTO and RPO) and continuity plans with the policy's waiting period so that operational recovery expectations and coverage terms are consistent.

Document the timeline and duration of any outage to support both incident response decisions and any potential claim, since duration often affects whether and to what extent business interruption loss is recoverable.