Small Shock, Large Wave

A drone costing €10,000 can force a major airport to suspend operations.

A cyberattack against one manufacturer can interrupt production across thousands of connected organisations.

A commercial ship dragging an anchor across the seabed can damage critical infrastructure, creating repair costs, security responses and investigations that continue long after the incident.

These examples are usually discussed separately.

One belongs to aviation security. Another to cybersecurity. The third to maritime infrastructure.

But they reveal the same structural change.

The cost of causing a disruption and the cost of absorbing it are becoming increasingly disconnected.

This is the central argument of our third article in The Cost of the Next Shock, a twelve-part THRIVE IN CHAOS research series examining how disruptions move through the global economy.

The first article explored how shocks reroute economic activity rather than simply spread.

The second examined the different timescales on which their costs emerge.

This week, we examine the multiplier that makes relatively small events economically expensive.

For much of economic history, causing large-scale disruption required substantial resources.

A naval blockade required warships. Destroying major infrastructure demanded expensive equipment. Interrupting industrial production generally required access to physical facilities or substantial military capabilities.

Today, many important economic systems can be disrupted through relatively inexpensive actions.

The reason is not simply that technology has become cheaper.

It is that economic activity has become increasingly concentrated.

Global trade depends on a limited number of maritime corridors. Manufacturers rely on specialised suppliers. Airports and industrial facilities depend on interconnected digital systems.

These arrangements create efficiency under normal conditions.

But the same concentration allows a relatively small incident to affect a large volume of economic activity.

Three conditions are particularly important.

The first is concentration: something valuable must pass through a narrow point.

The second is the relatively low cost of interruption.

The third is uncertainty about what happens next.

When all three are present, the economic cost of responding to a disruption can become much larger than the cost of causing it.

The original event may be small.

The resulting adjustment can extend across entire sectors.

One of the clearest examples comes from maritime insurance.

Our research examines the extraordinary increase in war-risk insurance premiums for ships operating in the Gulf during 2026.

Before the conflict, war-risk cover for a Gulf voyage reportedly cost around 0.15–0.25% of the vessel's hull value.

By October, quoted rates had reportedly reached 3–10%.

For a tanker valued at $100 million, that represents between $3 million and $10 million in insurance costs for a single passage.

The important distinction is that the premium is not limited to ships that suffer physical damage.

It applies to the possibility of future incidents.

A ship can complete its voyage safely and still incur substantial additional costs.

Those costs influence freight rates, commercial routes and the ability of smaller operators to remain competitive.

Insurance therefore performs two functions simultaneously.

It measures the market's assessment of risk.

But it also changes economic behaviour.

When coverage becomes expensive or unavailable, companies alter routes, delay shipments, consolidate cargo and reconsider commercial relationships.

The insurance market does not merely report a disruption.

It helps determine how far the economic consequences spread.

The same mechanism appears in cybersecurity.

The 2025 attack against Jaguar Land Rover caused production to stop for approximately five weeks.

According to the Cyber Monitoring Centre assessment cited in our research, the estimated impact on the British economy was £1.9 billion, with a modelled range of £1.6–2.1 billion.

More than 5,000 British organisations were affected.

The attack was directed at one manufacturer.

But its consequences extended across suppliers, contractors and connected businesses.

This illustrates the difference between the direct target of an incident and the economic system that absorbs its consequences.

The wider impact does not necessarily end when production resumes.

After major cyber losses, insurers may reassess the terms on which they provide coverage.

Premiums can rise, exclusions can become more restrictive and companies may be required to demonstrate stronger controls.

Businesses that were never attacked can therefore face higher costs because of an incident elsewhere.

This is one reason why traditional approaches to measuring risk are increasingly inadequate.

Counting the number of attacks or the immediate damage does not capture the full economic effect.

The most important part of the multiplier is uncertainty.

When an incident occurs, the people responsible for managing risk often cannot determine whether it was isolated or part of a wider pattern.

They may not know who caused it.

They may not know whether it will happen again.

And they may not know which system will be affected next.

Nevertheless, they must respond.

An airport must prepare for another drone.

A shipping company must insure its next voyage.

A manufacturer must demonstrate that its operations can survive a cyber incident.

The person or organisation causing the disruption pays for the action that occurred.

The defender must prepare for a much wider range of possible future events.

This is the asymmetry at the centre of the research.

The uncertainty itself becomes expensive.

And because confidence recovers more slowly than physical infrastructure, the costs can remain elevated long after the original incident.

The Red Sea provides a useful illustration of this persistence.

Container shipping companies began diverting services away from the Suez Canal in late 2023.

During the most severe period, weekly container capacity through the canal fell to a fraction of its previous level.

By early October 2026, the capacity had recovered to approximately 753,000 containers per week, or around 52% of the comparable 2023 level, according to figures cited from Clarksons Research.

That represented meaningful improvement.

But it also meant that almost half the previous capacity had not returned.

The issue was not simply whether ships could physically use the route.

Operators needed sufficient confidence that the security environment would remain stable.

They also needed acceptable insurance terms and a reason to reverse the alternative routes already established.

This distinction matters for economic forecasting.

A reduction in incidents does not necessarily produce an immediate reduction in operating costs.

Commercial confidence, contractual arrangements and insurance pricing may adjust on much longer timescales.

Another important consequence emerges when private insurance becomes too expensive for essential economic activity.

Governments may intervene.

Our research examines examples from India, South Korea and Japan, where public support mechanisms have been developed or expanded in response to maritime insurance pressures.

India reportedly established a maritime insurance pool of approximately $1.5 billion, supported by a sovereign guarantee of roughly $1.4 billion.

South Korea allocated funds to subsidise war-risk premiums for smaller shipping companies.

Japan pursued measures to support crude imports and cover certain maritime losses.

Each intervention may be justified by immediate economic needs.

But together, they illustrate a broader transfer of risk.

When private insurers cannot or will not provide affordable coverage, governments may absorb part of the exposure.

That moves the financial consequences from private contracts onto public balance sheets.

The original disruption therefore creates another layer of costs: contingent fiscal liabilities.

These obligations may remain after the immediate crisis has ended.

For policymakers and investors, the important question is not only how much governments spend today.

It is which risks they have committed to absorb in the future.

Our research identifies three broad possibilities.

Base scenario — 50% probability

Security incidents gradually decline, but insurance premiums and protection costs remain above their previous levels.

Businesses and governments absorb these expenses as part of a higher operating baseline.

Infrastructure protection and counter-drone programmes become permanent budget commitments.

Stress scenario — 35% probability

A second major disruption occurs before the consequences of the first have been fully absorbed.

Insurance capacity tightens across several categories, governments expand public guarantees and smaller operators face increasing pressure.

The central risk is not one catastrophic event but the accumulation of several disruptions drawing on the same financial and operational resources.

Relief scenario — 15% probability

Better forensic attribution, credible deterrence or a durable political settlement reduces uncertainty.

Risk premiums begin to decline more quickly because insurers and businesses become more confident about the probability of future incidents.

The distinction between these scenarios is not simply the number of attacks.

It is the degree of uncertainty that remains after them.

These probabilities are analytical judgments rather than model-generated certainty.

The article also records four specific forecasts with defined resolution dates.

By 31 December 2027 — 45% probability

Weekly container capacity transiting the Suez Canal exceeds 75% of its comparable 2023 level at least once.

The forecast will be evaluated using Clarksons Research data.

By 31 December 2029 — 40% probability

A European government formally attributes damage to subsea infrastructure in European waters to a state or state-directed actor, or a criminal conviction is secured.

The outcome will be assessed through official government statements or court records.

By 31 December 2031 — 55% probability

At least three G20 governments are operating state-backed or state-guaranteed marine war-risk insurance facilities.

The forecast will be checked against government announcements and industry reporting.

By 31 December 2036 — 55% probability

The Gulf and the Strait of Hormuz remain on the Joint War Committee's listed areas.

The outcome will be evaluated using the committee's published list.

Each forecast has a defined condition and date so that it can be assessed against future evidence.

The first practical step is to examine how indirect disruptions can affect personal finances and travel.

Before the next insurance renewal, review the policy wording rather than focusing only on the premium.

Pay particular attention to exclusions involving cyber incidents, airspace closures and other forms of disruption.

When planning important journeys, allow reasonable flexibility for delays or cancellations.

Over the following six months, maintain enough financial and logistical flexibility to absorb expenses that may not be covered by insurance.

The objective is not to prepare for every imaginable crisis.

It is to avoid making essential plans dependent on one route, one provider or one assumption about compensation.

For businesses, the immediate priority is to identify where uncertainty enters their operations.

Insurance is a useful starting point.

Ask the broker which exclusions have changed, what could trigger withdrawal of coverage and which operations would be affected if insurance became unavailable.

Then examine the company's critical dependencies.

Which suppliers could interrupt production?

Which transport routes are difficult to replace?

Which digital systems are essential for daily operations?

Over the next two quarters, develop a standing verification package.

It should contain current security attestations, a business continuity plan, named contacts and tested recovery times.

This package should be ready before a customer or insurer requests it.

The reason is commercial.

When uncertainty rises, customers increasingly want evidence that suppliers can continue operating.

A company that provides credible documentation quickly may preserve a contract that another company loses because it cannot demonstrate its resilience in time.

The advantage is not simply having better security.

It is reducing the uncertainty that other organisations must price when doing business with you.

For investors and business owners, the most important distinction is between the price of insurance and the availability of insurance.

A business can sometimes absorb higher premiums.

It may not be able to operate at all if essential coverage is withdrawn.

This risk is particularly relevant for transport, infrastructure and other sectors exposed to concentrated operational dependencies.

Investors should also examine the growing role of government guarantees.

Public insurance facilities and infrastructure protection programmes can transfer private risks onto national balance sheets.

These commitments may not be fully visible in conventional debt figures.

At the company level, it is useful to distinguish between businesses that pay for uncertainty and businesses that earn revenue by reducing it.

Security verification, continuity services and certain insurance capabilities may benefit from sustained demand while the underlying mechanism persists.

This is a structural observation, not an investment recommendation.

The central argument of this research is that the gap between the cost of disruption and the cost of response has become a structural feature of the global economy.

Three developments would weaken that conclusion.

First, if maritime war-risk premiums returned rapidly to near pre-conflict levels after a reopening, the multiplier would be less persistent than we currently expect.

Second, if successful attribution and prosecution of infrastructure incidents were followed by a measurable decline in similar events, uncertainty might prove more manageable than the current evidence suggests.

Third, if defensive technologies reduced the cost of protection to something close to the cost of attack, the economic advantage of inexpensive disruption would narrow.

These conditions are important because the purpose of the analysis is not to assume that disruption will inevitably become more expensive.

It is to identify the mechanism, monitor the evidence and revise conclusions when the underlying conditions change.

The most expensive part of many modern disruptions is not the initial damage.

It is the uncertainty that follows.

That uncertainty must be priced by insurers, businesses, governments and individuals who may never experience the original event directly.

This is why a small action can create a large economic wave.

It is also why recovery can take much longer than the physical repair of damaged infrastructure.

For decision-makers, the practical implication is clear.

Do not measure exposure only by the probability of being directly attacked or disrupted.

Examine how costs can reach you through insurance, suppliers, contracts and government responses.

And where possible, reduce the uncertainty that others must price when they depend on you.

In the next phase of the global economy, being resilient will matter. Being able to prove that resilience may matter just as much.

THRIVE IN CHAOS

The Cost of the Next Shock

Article 3 of 12 · Small Shock, Large Wave

Published 27 October 2026

Read the full research: thriveinchaos.ai

Signal → Meaning → Action → Stability

Strategic intelligence for decisions under uncertainty.

This publication provides analytical research, not individual investment or insurance advice.