A hyperscale data center campus can carry $20 billion to $30 billion in insurable value. The commercial insurance market typically puts up about $5 billion per site. The rest of that value is sitting somewhere, and most of the time nobody says out loud where.
I asked Jonathan York, co-founder and CTO of Luzern Risk, an AI-native captive manager, where that gap actually lives today, which perils are the real problem, and what captives, capital markets and even a federal backstop could do about it. Jonathan has spent 25 years in financial technology, including as head of client technology at Bridgewater Associates and CTO at Standard & Poor's. His answers are below, lightly formatted.
A hyperscale campus can carry $20B-$30B in insurable value but the commercial market absorbs about $5B per site. What happens to that gap today? Self-insured, uninsured, or buried somewhere in the lender's financing terms?
Today, the insurance protection gap is largely made up of risk that companies retain themselves or cannot obtain coverage for in the commercial market. We know from conversations in the industry that many firms are trying to secure coverage but can’t find acceptable rates or policies. Captive usage is increasing as an alternative.
Property risk coverage for the buildings may be available but equipment, data and business interruption risk are harder to insure at the scale these facilities require.
S&P estimates that only a third to half of a given data center campus is covered. Meta’s Hyperion campus has a $30B replacement cost and $4B in coverage. This gap will keep growing as these campuses add more in value than the market adds in capacity. Similar to banking before 2008, the current system hasn’t been tested.
We have not yet seen the full implications of a major, correlated loss affecting interconnected infrastructure at this scale. Companies have an opportunity to address that exposure in advance, rather than waiting until a significant event reveals where the coverage gaps are.
The market has figured out how to insure other mega-risks like LNG terminals and chip fabs. What makes data centers different?
Large, concentrated risks are nothing new. There are three key differences I’d point out with AI data centers. The speed, limited loss history and lack of direct physical risks.
First, this build out is happening much faster, which means there is not much loss history to price from. The market hasn’t had time to adapt.
Second, AI has become central to many parts of the economy much quicker than past mega-risks did, with much of the current and future economic activity dependent on AI. And third, the most important uncovered risks are not physical.
If we look at the examples of LNG and chip fabrication, they both developed over decades, producing a lot of loss history along with insurance capacity that grew as the assets did. They too became important to the economy, but over a much longer time frame. And their risks leaned largely physical.
Stepping back, the main thing I’d emphasize is that this build is looking unprecedented in scale and speed. AM Best says the coverage required is beyond what the P&C industry has previously experienced. The question is how the insurance market evolves to address that scale of risk while the infrastructure is still being built at a rapid pace and scale.
Which perils are the real problem: fire and battery storage, power or cooling failure, nat cat, or business interruption from an outage? Which one is most mispriced right now?
All of those perils can have a significant impact on data center operations. Business interruption stands out as probably the least covered and most consequential coverage challenge. That is not necessarily the same as saying it is the most mispriced risk. The more immediate issue is that the coverage available may not fully reflect the financial consequences of an outage.
Across these noted perils, the AI data center landscape has not yet found adequate coverage through existing solutions. And on top of that, none of these risks are fully priced in the traditional sense because the market isn’t clearing.
At the same time, the existing loss data has been informative. Allianz analyzed more than 200 data center claims and found fire was over 50% of the severity, with water damage the leader in frequency. Swiss Re found a similar pattern in its 15-year loss analysis. Fire accounted for 10% of claims but over 40% of costs.
Business interruption is the elephant in the room. Since much of data center risk isn’t physical, downtime that isn’t covered can have massive business and societal impacts. A famous example of uncovered non-physical downtime was the 2024 CrowdStrike incident. CrowdStrike caused the Fortune 500 an estimated $5.4B in losses, with 10-20% of that insured, per Parametrix.
Hyperscalers cluster in places like Northern Virginia, Phoenix and Dallas, often on the same grid. How should insurers and reinsurers think about that accumulation?
Recognizing that these facilities tend to be in clusters is the right step. Insurers and reinsurers take that into account when pricing the risk, assessing their proximity, shared dependence on utilities, and threats from natural disasters and other events.
The other side of the question is how much the data center owners are thinking about the accumulation. Differences in how they’re assessing that risk compared to the carriers could certainly contribute to a pricing mismatch.
We've begun to see what shared exposure looks like. In 2024, a single transmission fault in Northern Virginia knocked roughly 1,500 megawatts of data center load off the grid at once. Similar events of 1,300 to 1,800 megawatts followed in 2025. The North American grid reliability regulator, NERC, said the grid had not seen simultaneous load losses of that size before. It issued an industry-wide alert on the risk. The facilities had different owners, but that didn’t matter.
The concentration is likely going to intensify. Dominion's contracted data center pipeline in Virginia went from 21 gigawatts in mid-2024 to nearly 54 gigawatts two years later.
Big tech already runs captives. How much of this can captives realistically carry, and where do they hit a wall?
It’s not only big tech. The majority of the Fortune 500 across industries already run captives. Their usage will continue to grow from here, as they bring more of their risk into captives.
Looking at data centers specifically, Marsh forecasts “explosive” growth of captives taking on data center risk in the coming years.
Captives offer a more transparent and disciplined way of retaining risk than letting it opaquely sit on balance sheets. You would expect that over time shareholders, bondholders, and the insurance providers would demand that transparency.
The companies with the uninsured risks are already retaining it today. Using a captive to do it transparently will help assure their creditors, avoid surprises to their equity holders and negotiate more effectively with their insurance providers.
What would a capital markets structure for data center risk actually look like, and is there investor appetite for a peril set that isn't mostly nat cat?
Today it's very difficult for an investor to fund this risk at all. If we zoom out, we envision something over time that is closer to equity investing, where investors hold a variety of risk-capital positions as a diversifying asset class.
To create that type of marketplace, it requires infrastructure for transparency, pricing, and transactions. The risk needs to be divided into pieces that investors can model. This would allow them to express preferences and seek diversification based on different characteristics or strategies. That is why we favor more targeted instruments tied to specific perils or regions, rather than a single bond covering all data center risks.
Natural catastrophe risk offers a useful example because there is an established market there already, at about $65B outstanding, which is relatively small and growing rapidly compared to the overall capacity. I would view it as a niche and an early example of a much broader ecosystem of risk capital investing that could be possible in the future.
On a limited federal backstop: what would trigger it, and how do you answer the taxpayer asking why they should backstop privately owned tech infrastructure?
Given how structurally important these buildings are, a narrowly defined federal role may be worth considering for the most extreme losses, where private insurance and capital markets cannot provide sufficient capacity.
Exactly how that role is defined is an open question. One approach could require formal certification of a qualifying event, with access to the backstop dependent on your company meeting risk-management standards.
When thinking about how different organizations and people may react, I’d say there's an opportunity to make a return from these risks if priced correctly. As capital markets develop and transparency improves, private capacity may expand. That should be part of the solution before relying on public support for exposures the market cannot absorb.
If a broker or underwriter gets their first data center submission tomorrow, what are the first three things they should ask?
I’ll leave the specific underwriting question to those who specialize in assessing these specific risks. From our perspective, it’s important to emphasize the quick-moving nature of the industry. There is a lot to be learned as the AI build out continues and we should not count on the existing ways of thinking to perfectly capture the risk.
Understanding how the facility operates, what it depends on and what happens financially if it goes offline will be critical to assessing the risk properly.
Jonathan York is co-founder and CTO of Luzern Risk, an AI-native captive manager.