Cyber Insurance & State-Actor Exclusions

Glossary

Aggregation (accumulation) risk

The risk that a single event — one vulnerability, one compromised vendor, one faulty update — produces simultaneous, correlated losses across many insureds at once. It is the defining feature separating cyber from geographically bounded physical perils and the reason cyber needs its own capital and modeling.

Coinsurance

A term, common on ransomware, requiring the policyholder to bear a stated percentage of a loss even above the retention. It aligns the operator's incentives by forcing it to co-own the ransom decision, expressing the market's shift from loss transfer to loss sharing.

Cyber tower

The layered structure of a cyber insurance program: a retention absorbed by the operator, a primary layer, and excess layers stacked above it, often across many carriers so no single insurer concentrates too much exposure on one risk.

Silent cyber

Digital-loss exposure sitting inside traditional property or liability policies that neither clearly grant nor clearly exclude cyber coverage. The ambiguity prompted regulators and the Lloyd's market to require insurers to affirm or exclude cyber explicitly, giving rise to standalone policies.

State-backed cyber exclusion

A modern, cyber-specific rewrite of the war exclusion, developed after NotPetya, that excludes losses arising from state-backed cyberattacks. Its operation hinges on attribution — determining that a state was responsible, and by what standard — which is the contested hinge of the whole clause.

Sublimit

A cap on a specific coverage grant (such as ransomware or contingent business interruption) that is lower than the tower's overall limit. A large headline limit can conceal a small sublimit on the exposure that actually threatens the operator.

Technology errors and omissions (tech E&O)

Professional liability coverage for a company whose technology product or service fails to perform and causes a third party financial harm. It overlaps with cyber liability and must be coordinated with it, and it carries the same accumulation risk when one vendor sits inside many customers' operations.

Waiting period (time retention)

The interval that must elapse after systems fail before cyber business-interruption coverage begins to respond. Losses inside the window are the operator's, which makes the period as economically important as the limit for high-downtime-cost facilities.