Cyber insurers are failing to reduce companies' cyber risk exposure and to cover breached firms' costs after state-sponsored cyberattacks that fall short of war
Cyberinsurance doesn't cover acts of war. But even as cyberattacks mount, the definition of “warlike” actions remains blurry.
Context & Ripple Effects
The coverage gap this story describes has been widening for years. After NotPetya, insurers invoked war-exclusion clauses to deny claims from companies hit by collateral damage of a state-backed operation, establishing the template for refusing payouts (NotPetya claim denials). The ransomware surge then upended the market itself, pushing premiums and underwriting requirements up just as more firms sought cover (ransomware surge upends cyber insurance).
Lloyd's of London then moved to codify the ambiguity, requiring insurer groups in its marketplace to exclude state-backed hacks from stand-alone cyber policies starting in 2023 (Lloyd's state-backed hack exclusion). What remains unresolved — and what this reporting highlights — is where 'warlike' ends: most state-sponsored attacks fall short of war, leaving policyholders exposed in exactly the scenarios insurers cite to deny claims.
First-order effects
- Breached companies holding stand-alone cyber policies face denied or contested claims when an attacker is state-linked but not legally 'war,' repeating the NotPetya denial pattern at larger scale.
- Insurers that raised direct-written premiums 92% in 2021 after high-profile hacks (92% premium increase) are collecting more while narrowing what they will actually pay out.
Second-order effects
- Lloyd's marketplace-wide exclusion forces every syndicate writing stand-alone cyber cover to adopt the same state-backed carve-out, standardizing the gap across the market rather than leaving it to individual underwriters.
- Brokers quantifying the damage — Howden counts roughly £44B in lost UK revenue over five years, with 52% of companies reporting at least one attack (Howden £44B UK loss estimate) — give corporate buyers evidence to demand clarity on exclusions before renewing.
Third-order effects
- If state-backed exclusions become the norm, cyber insurance stops functioning as a transfer mechanism for the fastest-growing class of severe attacks, and the question of who absorbs nation-state risk — policyholders, insurers, or governments — moves toward regulators and policymakers.
- The durable shift is from insurance as protection to insurance as a tightly scoped product: buyers pay rising premiums for cover that excludes the scenarios driving their actual loss experience, weakening the market's core value proposition.
The trend: Cyber insurance is contracting into a narrower product — higher premiums, stricter underwriting, and explicit state-backed carve-outs — precisely as state-sponsored attacks become the dominant severe-loss scenario.