--- title: "What percentage of revenue is from ecommerce / online advertising?" url: https://insuranceposture.com/questions/business-profile/percentage-revenue-from-ecommerce-online-advertising category: "Business and financial profile" canonical_key: q_fin_002 evidence_state: attested updated: 2026-08-24 --- # What percentage of revenue is from ecommerce / online advertising? URL: https://insuranceposture.com/questions/business-profile/percentage-revenue-from-ecommerce-online-advertising Section: Business and financial profile Evidence state: Attested, not tenant-verifiable The higher this percentage, the more an hour of downtime costs, and the more of your exposure sits on a public-facing system. ## What the carrier is actually asking The carrier is asking what share of revenue comes through online channels, including ecommerce and online advertising. It is measuring dependence on internet-facing systems. ## Why it is underwritten Online revenue stops the moment the site does, which makes business interruption immediate and measurable. It also concentrates exposure on public-facing infrastructure and, where cards are processed, on payment data. Carriers price both effects. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Revenue attribution comes from your finance systems. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Finance | Revenue by channel for the period | A supportable split between online and other channels. Attested | | Platform | The ecommerce platform and its hosting model | Whether the platform is hosted by a vendor or by you, which determines who patches it | | Payments | How card data is handled in the online flow | Consistency with the payment outsourcing answer | | Availability | Redundancy and failover for the revenue-generating platform | Design that limits outage duration for the systems carrying revenue | | Web | Third-party scripts running on transaction pages | Script inventory, since compromised scripts on payment pages are a recurring loss source | **Third-party scripts on checkout pages** A high ecommerce share concentrates risk on the checkout page, and that page typically loads scripts from analytics, chat, and advertising vendors. A compromise of any of them can skim card data without touching your servers. Script integrity controls are the answer, and few applications ask about them directly. ## What a defensible yes requires - The percentage is supported by revenue reporting. - The platform hosting model and patch responsibility are known. - Payment handling is consistent with the card processing answer. - The revenue-generating platform has availability design proportionate to its importance. - Third-party scripts on transaction pages are inventoried and controlled. ## How this answer goes wrong The percentage is estimated low because online is not how the business thinks of itself, while a majority of orders arrive through the website. The business interruption cover is then sized against the wrong channel mix. ## If this answer turns out to be wrong Revenue and record counts are the rating base, so a misstatement here is material as arithmetic, and it is the category where insurers have historically reached for rescission. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how rescission voids a policy from inception](https://insuranceposture.com/glossary/rescission). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Does a high percentage hurt? It raises business interruption exposure and it is not a negative in itself. Carriers write online businesses routinely; they price the dependency. ### Does online advertising revenue count? The question usually asks about it explicitly because it carries similar dependency on availability and on third-party platforms. ### What if we sell only through marketplaces? Say so. Your dependency is on the marketplace rather than on your own infrastructure, which is a different profile worth describing. ### How precise should the figure be? A supportable approximation. The carrier is placing you in a band rather than auditing the split. ## Related questions - [What is the Applicant's annual gross revenue (current / previous fiscal year)?](https://insuranceposture.com/questions/business-profile/applicant-s-annual-gross-revenue) - [Is the Applicant PCI-DSS compliant, and at what merchant level?](https://insuranceposture.com/questions/data-handling/applicant-pci-dss-compliant-at-merchant-level) - [Does the Applicant fully outsource payment card processing?](https://insuranceposture.com/questions/third-parties/applicant-fully-outsource-payment-card-processing) - [Has the Applicant experienced any partial or total network interruption lasting more than 8 hours?](https://insuranceposture.com/questions/incident-response/applicant-experienced-partial-total-network-interruption-lasting-more-than) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.