Cyber insurance war exclusion: why attribution decides accumulation

A cyber insurance war exclusion removes cover for losses arising from war; since late 2021 the London market has also had exclusions written specifically for cyber war. GAO recorded in 2022 that "insurers are excluding coverage for losses from cyber warfare and infrastructure outages", and that "“Act of war” exclusions are generally found in policies issued in most lines of insurance, including cyber" (GAO-22-104256, June 2022). For accumulation the exclusion's wording matters less than its timing. Whether it applies depends on attributing the attack to a state, and attribution of the 2017 NotPetya attack took the UK government nearly eight months and a U.S. indictment more than three years. A cyber accumulation estimate is needed within hours of an event, so it cannot assume the exclusion will hold. Botminds' Cyber Accumulation Management treats the cause as a switch: a system failure counts only policies that cover it; a malicious attack counts all, and the head of cyber decides which view goes to the reinsurers.

Product screens show a fictional sample book (Thistlebrook Specialty) and a fictional vendor outage; every company in them is invented. Public facts come from GAO, the UK government, the U.S. Department of Justice and insurance supervisors, linked where they appear.

What is a cyber war exclusion?

It is a clause that removes cover for losses caused by war, extended or rewritten so that it reaches cyber operations. Traditional war exclusions are old and almost universal; GAO noted that "Insurance policies generally exclude losses from events with potential catastrophic and systemic effects, such as acts of war." The difficulty is definition. GAO quotes one federal statutory definition of "act of war" (an act in the course of declared war, armed conflict between nations, or armed conflict between military forces of any origin, 18 U.S.C. § 2331(4)) and adds that "contractual definitions of “act of war” vary."

The cyber-specific versions are recent. GAO recorded that "in November 2021, Lloyd’s Market Association introduced specific exclusions for cyber war, and, according to media reports, at least one other large insurer is planning to adopt similar exclusions" (GAO-22-104256). The details of those clauses, and of any treaty's own war wording, are wording questions; for treaty language, the reinsurance series on reinsurance contract review is the place to go.

Does cyber insurance cover nation state attacks?

Generally not, if the attack is attributed to a state and the policy's war or state-backed attack exclusion holds; generally yes, if it is not attributed or the exclusion does not reach it. GAO's summary was that "private insurers have been taking steps to limit their potential losses from systemic cyber events. For example, insurers are excluding coverage for losses from cyber warfare and infrastructure outages."

UK insurers told their supervisor the same. In the PRA's 2022 stress test, insurers "were broadly aligned and forthcoming in their responses that their intent was not to cover incidents or acts where such nation-state involvement was evident. However, many recognised that there are challenges and sensitivities regarding the attribution of a cyber incident or act to a nation-state" (PRA, Insurance Stress Test 2022 feedback, January 2023). "Evident" is doing all the work in that sentence.

How is a cyber attack attributed to a state?

Slowly, by governments, on intelligence that insurers cannot see. NotPetya is the reference case. The malware struck on 27 June 2017. On 15 February 2018 the UK government said that "the Russian Government, specifically the Russian military, was responsible", adding that "The attack masqueraded as a criminal enterprise but its purpose was principally to disrupt" (GOV.UK, 15 February 2018). On 19 October 2020 the U.S. Department of Justice charged six officers of Russia's military intelligence service, alleging that NotPetya "caused nearly $1 billion in losses to the three victims identified in the indictment alone" (U.S. Department of Justice, 19 October 2020).

Insurers' own capability is uneven. When the IAIS asked jurisdictions whether insurers can identify state-sponsored attacks, "which are increasing and are normally excluded from coverage, although attribution of these actions are often difficult", it found "equal numbers of jurisdictions reporting full, partial or no capability to identify such threats" (IAIS Global Insurance Market Report 2025). The same report notes that attribution "is an obstacle for insurers in some jurisdictions to enter into the cyber market."

Why attribution decides accumulation

Because the exclusion can turn a book-wide loss into a small one, or not, and nobody knows which on the day. A state-backed attack on a widely used software vendor is the scenario in which the exclusion matters most and in which attribution is most contested: the attack may be designed, as the UK said of NotPetya, to look criminal. An estimate that assumes the exclusion holds can be wrong by the whole accumulation; one that ignores the exclusion can overstate the net by the same amount.

Uncertainties regarding the definition of an act of war, including cyber risks, and the potential identification of the attackers' source from state or government-related agencies, might inhibit the development of robust, socially beneficial cyber insurance markets.

EIOPA, Supervisory Statement on management of non-affirmative cyber exposures, 2022

EIOPA asked insurers to look at "the characterisation of cyber events as hostile, terrorism or warlike and the related challenges related to these assessments (e.g. identifying the perpetrator or establishing potential links to a state authority)" when drafting terms. For an accumulation team the practical rule follows: carry two estimates until attribution is settled, label which is which, and let a named person decide which one leads the note to the reinsurers.

Who decides if a cyber attack is an act of war?

For the policy, the insurer decides whether to invoke the exclusion, and if the insured disputes it, a court or arbitrator decides whether it holds. Governments' attributions inform both, but a contract's definition governs, and GAO's point that "contractual definitions of “act of war” vary" means two policies can give different answers for the same attack.

Inside the insurer, invoking the exclusion should be a named person's decision with a written basis, not a modelling default. Some UK insurers told the PRA they already work this way: "some entities reported that they have a specific governance approach to invoking this language and have considered potential costs that may be incurred." In Cyber Accumulation Management, agents never set the cause; the estimate shows both system failure and malicious attack, and the head of cyber decides which is treated as current, on the event's timeline with her reason.

Cause as a switch: the same outage estimated as system failure or as an attack

What is an infrastructure exclusion in cyber insurance?

It is a clause that removes cover for losses from failures of infrastructure outside the insured's control. GAO described it: "some cyber insurers exclude losses from outages of critical infrastructure services that are not under the control of the policyholder", such as electric utilities and telecommunications, including "any failure of telephone lines, data transmission lines, and other telecommunications or networking infrastructure" (GAO-22-104256). These events, GAO noted, "can spread to multiple systems, disrupting businesses and supply chains."

For accumulation, the question is whether a given shared vendor falls inside the wording. A power-grid failure clearly may; whether a cloud region, a domain name service or a content delivery network counts as "networking infrastructure" is a matter for each policy's definitions. The policy reader's job is to record what the wording says for each insured, and to count a dependency as not covered only where the wording says so.

Modelling the event both ways

Supervisors already ask for it. In its 2022 cloud-down scenario the PRA told insurers that "while it is feared that the threat actor may benefit from the tacit support of a nation state, this cannot be proved and so insurers should assume that war exclusions cannot be applied" (PRA IST 2022 scenario specification). The same exercise asked what would happen if key exclusions in general did not perform, and found few insurers could answer.

"In general, responses regarding key exclusions were limited and generalised," the PRA wrote. The fix is not a better model of attribution; it is a second estimate. In the sample book, a malicious cause brings the 63 insureds with attack-only dependent cover into the count, and every estimate the solution draws can be shown both ways.

The what-if on the dependency web: who is past the waiting period at each length

What the exclusion means for reinsurance and the federal backstop

Two things follow for the people who buy protection. First, the event cover's own terms may treat war and state-backed attack differently from the original policies, so a loss excluded on the direct side is not the only question; the treaty's wording decides what the reinsurer pays. Second, war sits outside the U.S. terrorism backstop as well: GAO notes that to be certified under the terrorism program, "The act must not be part of the course of a war declared by Congress, except for workers’ compensation claims." Where the federal assessment of a cyber backstop stands is set out in cyber insurance backstop.

Questions people ask

What did GAO say about cyber war exclusions?

In June 2022 GAO reported that insurers were excluding losses from cyber warfare and infrastructure outages to limit systemic exposure, that act-of-war exclusions appear in most lines including cyber, and that contractual definitions of act of war vary. It recorded that cyber-war-specific exclusions were introduced in the London market in November 2021.

When did the market introduce cyber war exclusions?

GAO records November 2021 for the introduction of specific cyber war exclusions by the London market's association of managing agents. Traditional war exclusions were already in most policies long before.

Was NotPetya an act of war?

The UK government attributed it to the Russian military in February 2018, and the U.S. charged six Russian military intelligence officers in October 2020. Whether any insurance policy treated it as war depended on that policy's wording and, where disputed, on the courts.

Can an insurer invoke a war exclusion before a government attributes the attack?

It can try, but it carries the burden of showing the exclusion applies, and attribution evidence may not be public. EIOPA reminded insurers that, depending on the governing law, "the burden of proof regarding the existence of the exclusion to the coverage, may often rest with the insurance undertaking."

Should a cyber cat model apply war exclusions?

Run it both ways. Treasury's own modelling for its 2026 terrorism program report applied no exclusions at all, and the PRA's cloud scenario told insurers to assume war exclusions could not be applied. An estimate with the exclusion holding is a scenario, not a base case.