Definition:Cyber war exclusion
⚔️ Cyber war exclusion is a policy exclusion clause embedded in cyber insurance contracts — and increasingly in broader property and casualty policies — that removes coverage for losses arising from cyber operations conducted as part of, or in connection with, war or state-sponsored hostile activity. The clause addresses one of the most consequential coverage ambiguities the insurance market has faced: whether traditional war exclusions, originally drafted for kinetic conflict, extend to cyberattacks launched by nation-states. High-profile disputes — most notably litigation surrounding the NotPetya attack of 2017, where carriers denied claims under war exclusions on property policies — forced the industry to develop cyber-specific war language.
🔧 Lloyd's took a leading role in standardizing the approach when it mandated, effective from early 2023, that all standalone cyber policies written through the Lloyd's market include a clear state-backed cyber attack exclusion meeting one of several approved model wordings issued by the Lloyd's Market Association. These model clauses generally exclude attacks attributable to a state or state-sponsored actor that have a major detrimental impact on the functioning of a state, while requiring carriers to specify the attribution mechanism used. Beyond Lloyd's, markets in the United States, Continental Europe, and Asia-Pacific have grappled with similar questions, though approaches vary: some reinsurers have introduced their own exclusionary language, while regulators in certain jurisdictions have pushed for greater transparency about what is and is not covered. The practical challenge lies in attribution — determining, often in real time, whether a cyberattack constitutes an act of war or mere criminal activity, a distinction that intelligence agencies themselves struggle with.
📌 Getting the war exclusion right carries enormous financial stakes for insurers and policyholders alike. For insurers and reinsurers, ambiguous language creates silent cyber exposure — the risk that cyber losses leak into policies never priced for them. For policyholders, an overly broad exclusion can hollow out the very protection they purchased, particularly since sophisticated state actors are responsible for a significant share of global cyberattacks. The ongoing refinement of cyber war exclusion language reflects a broader maturation of the cyber insurance market: moving from vague, repurposed traditional wordings toward precise, purpose-built contract terms that allocate risk clearly and sustainably.
Related concepts: