War and the Hostile-State-Actor Exclusion
The war exclusion is the fault line running under the entire cyber market. It was written for armies and borders, then asked to govern malware that recognizes neither. NotPetya forced the question into court, and the courts told insurers that a clause built for tanks would not stretch to code by default. The industry's answer was to rewrite the clause explicitly for cyber — and in doing so it exposed the real problem, which is attribution. My read: whoever gets to decide who fired the shot effectively decides whether the policy pays. Attribution is not a technical footnote here. It is the whole contest.
Knowledge check
Why did the NotPetya litigation embarrass the traditional war exclusion, and what did insurers do in response?
Show the answer
The traditional war exclusion was written for armed conflict between states, and courts (in the Merck litigation over the 2017 NotPetya attack) declined to apply that legacy language to a cyberattack absent clearer wording, holding that a reasonable policyholder would not have understood the clause to reach non-physical cyber operations. In response, the market — led by Lloyd's — introduced explicit state-backed cyber attack exclusion clauses that address cyber operations directly and shift the debate onto attribution: who decides that a state was responsible, and by what evidence.