Affirmative vs non affirmative cyber: two sources of one accumulation

Affirmative cyber is cover that a policy explicitly grants for cyber risk: a standalone cyber policy, or a cyber endorsement added to another policy. Non-affirmative cyber, also called silent cyber, is exposure to cyber loss under a policy that neither explicitly includes nor excludes it, typically property, casualty, directors' and officers', professional indemnity or marine cover written without cyber in mind. The distinction matters for accumulation because one event does not choose: a cloud outage, a destructive worm or a compromised software update can trigger losses under both at the same time. A count of exposure to a shared vendor that reads only the standalone cyber book measures one source and leaves the other unmeasured. Botminds' Cyber Accumulation Management builds the list of insureds that depend on each shared vendor, with evidence, and reads all 418 in-force policies on the vendor in the sample book; that same list is what an insurer needs to test its non-cyber lines against the same event.

Examples come from regulators' published texts and from a fictional sample book (Thistlebrook Specialty, a standalone cyber book of 2,846 insureds) run through the solution. Every company in the sample is invented.

What is the difference between affirmative and non affirmative cyber?

Whether the policy says so. The UK Prudential Regulation Authority's supervisory statement draws the line exactly: affirmative cyber risk means "insurance policies that explicitly include coverage for cyber risk", and non-affirmative cyber risk means "insurance policies that do not explicitly include or exclude coverage for cyber risk", which the statement adds "is sometimes referred to as ‘silent’ cyber risk by insurance professionals" (PRA SS4/17, 1.6). The PRA expects firms "to be able to identify, quantify and manage" both.

The difference is not between cyber and non-cyber policies. A cyber policy with an ambiguous exclusion can carry silent exposure, and a property policy with a cyber endorsement carries affirmative cover. EIOPA makes the point directly: exposures "could originate from both affirmative cyber insurance policies or cyber endorsements, for which some exclusions may not be clear, and in relation to insurance policies designed without explicitly taking cyber risk into consideration" (EIOPA Supervisory Statement on non-affirmative cyber exposures, 2022).

What is silent cyber?

Silent cyber is the cyber exposure a policy carries because it says nothing about cyber. EIOPA's definition is the one most often quoted: "Non-affirmative cyber exposure (also called “silent cyber”) refers to instances where cyber coverage is neither explicitly included nor excluded within an insurance policy." New York's DFS used the same idea in its 2021 cyber framework, describing losses "in insurance policies that do not explicitly grant or exclude cyber coverage – so-called “non-affirmative” or “silent” risk" (NYDFS Insurance Circular Letter No. 2, 2021).

It is silent in two senses. The wording is silent, so cover depends on how a court reads a general clause against a cyber cause. And the exposure is silent in the books, because no one recorded a cyber limit against it, so it appears in no cyber accumulation report until a claim arrives.

Why do regulators care about silent cyber?

Because the largest cyber loss on record arrived mostly through it. The NotPetya malware of June 2017, which spread from a compromised Ukrainian tax-accounting software update, "is estimated to have caused about $10 billion in damages globally", according to the Justice and Homeland Security departments as cited by GAO (GAO-22-104256, June 2022). New York's DFS, citing a Carnegie Endowment study, put the insured part at $3 billion of claims, $2.7 billion of them under property and casualty policies that said nothing about cyber.

That ratio explains the supervisory attention since. EIOPA described what happens when silent exposure meets a real event.

If a cyber event materialises, this can lead to potentially significant and unexpected losses across lines of business, ultimately leading to time-consuming, expensive, and unpredictable litigation.

EIOPA, Supervisory Statement on management of non-affirmative cyber exposures, 2022

Where silent exposure sat in 2019, and where it sits now

In 2019 it was everywhere and unmeasured; by 2022 it had shrunk to a small share of modelled losses, concentrated in liability lines. The PRA's 2018 survey of UK specialist insurers found that "Casualty, financial, motor and A&H lines were noted to have the largest non-affirmative exposure", and that estimates for property and marine, aviation and transport lines ranged "anywhere between zero and the full limits" (PRA letter to chief executives, 30 January 2019).

Four years later the PRA's stress test told a different story. Across its three cyber scenarios, "The share of losses from non-affirmative exposures accounted for 7% of the total gross losses for each of the scenarios (excluding Society of Lloyd’s)", which the PRA put down to "market-wide efforts to affirm or exclude non-affirmative cyber following the letter to CEOs in January 2019". What remained came "largely" from directors' and officers' and professional indemnity cover, "not unexpected given that liability lines generally use peril-agnostic triggers for coverage, such as negligence" (PRA, Insurance Stress Test 2022 feedback, January 2023).

Read those bars with care. An entity reporting no silent loss may have excluded it cleanly, or may not have been able to find it; the stress test could not tell the two apart, and the PRA asked firms to "continue to robustly assess and actively manage this exposure".

How do insurers remove silent cyber?

By making every policy say what it does with cyber: cover it explicitly, for a price and a limit, or exclude it with wording that holds. New York's DFS framed the end state in 2021: every policy that could meet a cyber claim should say whether it covers or excludes cyber-related loss, and until then insurers should reduce the silent exposure they hold, for example through reinsurance. The NYDFS framework read as underwriting checks takes that practice further.

Affirming has a consequence that is easy to miss: it grows the affirmative count. The NAIC reported in October 2026 that cyber endorsements on other commercial policies make up nearly two-thirds of U.S. cyber policies in force (NAIC news release, 21 October 2026). Each of those endorsements is affirmative cyber, and each sits on an insured that depends on the same few clouds, identity providers and payroll platforms as the standalone book.

Is silent cyber still a problem?

Smaller, but not solved, and harder to see than before. The IAIS's 2025 market report found that supervisors do not currently regard insurers' cyber underwriting as a threat to financial stability, but added: "However, significant data gaps remain in gauging the systemic risk posed by non-affirmative coverage" (IAIS Global Insurance Market Report 2025). The PRA's 2022 test found residual silent exposure in liability lines whose triggers do not care what caused the loss.

The remaining problem is overlap. The BIS's Financial Stability Institute and the IAIS noted in 2026 that cover for one cyber incident can sit in cyber, crime, property and liability policies at once, and that "Such overlaps can contribute to accumulation risks, as a single and widespread cyber incident may trigger claims across multiple insurance policies simultaneously" (FSI Insights No 75, 2026). An exclusion that is clean in one line does nothing for the insured's other policies.

What is the PRA supervisory statement on cyber?

It is SS4/17, Cyber insurance underwriting risk, first published in July 2017 and still current on the PRA Rulebook. It sets expectations for UK non-life insurers, including Lloyd's managing agents, in three areas: non-affirmative cyber risk, cyber strategy and risk appetite, and cyber expertise. On silent cyber it expects firms to assess "all property and casualty (P&C) covers which could give rise to cyber risk exposure from physical and non-physical damage", and to bring the residual exposure within the board's risk appetite.

It also links silent cyber directly to accumulation: the board's information should include aggregate exposure for both kinds of cyber risk and stress tests that consider loss aggregation. How those measures fit a board pack is set out in the cyber accumulation management program.

Counting both sources against one event

Start from the shared vendor, not from the policy. The question for an outage at a cloud region is which insureds depend on it; once that list exists, the same insureds can be looked up in every line the insurer writes. The cyber book answers with dependent business interruption, waiting periods and sublimits; the liability book answers with the insureds whose customers may sue for missed deliveries; the property book answers only where systems control physical assets.

The named list that both counts start from: every insured on the vendor, with evidence and terms

In the sample book, the policy reader found that 63 of the 418 insureds on the failed vendor had dependent cover for attacks only. That is an affirmative-cover question, settled by reading the wording, and it shows why reading matters more than counting: the same insureds would respond differently under a property or liability policy whose wording is silent on cause. War and state-backed attack exclusions add a third branch, discussed in cyber insurance war exclusion.

The whole book around its shared vendors, sized by limit

Questions people ask

Is a cyber endorsement affirmative or silent cover?

Affirmative: an endorsement that grants cyber cover says so explicitly. It belongs in the cyber accumulation count, even though it sits on a property or package policy. The NAIC reports that endorsements are now nearly two-thirds of U.S. cyber policies in force.

What did EIOPA say about non affirmative cyber?

In its 2022 supervisory statement, EIOPA asked supervisors to check that insurers measure silent exposure, clarify wordings, use consistent cyber terminology and monitor the threat landscape. It also asked them to ensure insurers account for "concentration and accumulation risk" and use reinsurance against cyber accumulation.

Which lines carry the most silent cyber today?

In the PRA's 2022 stress test, what remained came largely from directors' and officers' and professional indemnity cover, because liability triggers such as negligence do not depend on the cause. In 2018 firms had named casualty, financial, motor and accident and health lines.

Does excluding cyber from property policies remove the accumulation?

It removes that line's share, if the wording holds. The insured's dependence on the vendor is unchanged, so the loss moves to whatever policy still responds, or stays with the insured. The IAIS notes that newer exclusionary language has not all been tested in court.

Should non-affirmative exposure be part of a cyber stress test?

Yes. New York's DFS says accurate stress testing requires accounting for both silent and affirmative risk, and the PRA's 2022 scenarios asked for losses on non-affirmative cover in other product lines alongside standalone cyber.