Lloyd's of London will require insurer groups in its global marketplace to exclude state-backed hacks from stand-alone cyber insurance policies starting in 2023
James Rundle / Wall Street Journal : Tweets: @paul__armstrong and @danielkennedy74 Tweets: Paul Armstrong / @paul__armstrong : Non-cover usually implies the likelihood of something happening is too high...which is great. 🙁 https://twitter.com/... Dan Kennedy / @danielkennedy74 : “The other significance is that policyholders may be left without support or critical services from their insurer pending government attribution...” https://www.wsj.com/...
Context & Ripple Effects
Lloyd's is formalizing a line that was already being drawn in practice: after NotPetya, companies were denied coverage under war-exclusion clauses even though the attack fell short of declared war. The new mandate makes that ambiguity explicit policy across the marketplace — state-backed attacks are out of stand-alone cyber policies from 2023.
The move lands on a market already repricing hard: direct-written cyber premiums at the largest insurers rose 92% year over year in 2021 after high-profile hacks, and reporting since has found insurers failing to cover breached firms' costs after state-sponsored attacks that stop short of war. Lloyd's is choosing to price that risk out rather than carry it.
First-order effects
- Policyholders buying stand-alone cyber cover through Lloyd's syndicates lose protection against state-backed attacks, and as Dan Kennedy notes, may be left without insurer support while government attribution of an attack is still pending.
- Insurer groups in the marketplace must rewrite policy wording for 2023 renewals, shifting the cost of nation-state incidents back onto corporate balance sheets.
Second-order effects
- Buyers facing narrower cover on top of sharply higher premiums have less reason to treat stand-alone cyber policies as their primary breach backstop, pressuring insurers to justify the product's value beyond excluded scenarios.
- The exclusion sharpens the attribution problem into a commercial one: whether a claim pays can hinge on a government's naming of the attacker, pushing corporates toward sovereign-backed or captive alternatives outside the Lloyd's market.
Third-order effects
- The carve-out logic is spreading to new risk classes rather than reversing — QBE and Beazley are now moving to cap payouts tied to AI use and LLMjacking losses — suggesting insurers will systematically exclude hard-to-price systemic threats.
- If the pattern holds, cyber insurance becomes a shrinking-coverage, growing-premium product: global premium volume is still projected to reach roughly $30B by 2030 per Bloomberg's reporting, but an expanding share of catastrophic risk sits permanently uninsured.
The trend: Cyber insurers are responding to unpriceable state-linked and emerging-tech risk not with better models but with exclusions and caps, steadily transferring catastrophic tail risk back to the insured.