War Exclusion Clause – When Does it Apply Under a Cyber Insurance Policy?

Listen to the audio version:

With recent events in Ukraine and Israel and the evolving nature of warfare with the potential for cyber attacks on both private and public institutions, there is widespread attention on the war exclusion clause and when it applies under a business’s cyber insurance policy. “We cannot say definitively that events arising out of the current Israel-Hamas conflict could trigger the war exclusion, but it would need to cross several hurdles for it to apply to a U.S. business,” said David Finz with Alliant Specialty Claims.

Finz also distinguishes that the war exclusion clause has never been invoked on a claim reported under a cyber policy. There have been cyber claims for which insureds have sought coverage under their property or general liability policies where the carriers have attempted to deny coverage under the war exclusion. The wording of the war exclusion under those policies is often very different from what is found under a cyber policy.

Lloyd's Cyber War Exclusion Guidance
Lloyd's of London recently issued language around war exclusions to its syndicates, yet even the revised wording would not necessarily have triggered the war exclusion on cyber policies for any event that has actually taken place related to current turmoil overseas. Lloyd’s war exclusion guidance is considered the direction where coverage is heading, yet the U.S. market is still deciding how to approach this issue. The exact wording of the war exclusion varies from carrier to carrier, and there is no standard war exclusion amongst cyber carriers.

When Does War Exclusion Apply?
There are several factors involved in determining whether the war exclusion applies under a business’s cyber insurance policy, including:

• Act of war: Is there a declared, kinetic war taking place somewhere?
• Attribution: Who is deciding whether it's an act of war? Who is taking responsibility for the attack?
• Location: Did the cyber attack take place within the theater of conflict or on the territory of another sovereign state?
• Intended target: Was the business or the insured suffering the attack the intended target, or collateral damage?

The exact wording of the war exclusion varies from carrier to carrier, and the extent to which the war exclusion would apply depends both on these factors as well as the exact wording of the policy. It’s also important to consider that there is a carve back on almost every carrier's war exclusion for cyber terrorism. If a non-state actor is launching an attack to further their own agenda, and there's not clear attribution to a state sponsor, then the cyber terrorism carve back would most likely kick in.

Alliant is actively following global developments and the implications on clients’ risk management strategies. Contact your Alliant broker if you have questions or to request a review of your cyber policy from Alliant Cyber.

For more information, visit Alliant Cyber