The gap between these two columns is where uninsured losses live. A firm like Bloc Cyber reviews coverage at the insuring-agreement level precisely because a bundled checkbox does not reveal these gaps until a claim is filed.
How long does a typical breach investigation take for a small business? Most forensic investigations for companies with fewer than 500 employees take two to six weeks, though complex cases involving multiple systems or poor logging can extend to three months.
Does general liability insurance cover data breaches? No. Standard general liability and commercial property policies exclude electronic data and cyber events. You need a standalone cyber liability policy form to respond to breach costs.
What triggers a notification obligation? Each state defines it differently, but most statutes are triggered when personally identifiable information, such as Social Security numbers, financial account data, or medical records, is accessed or acquired by an unauthorized party.
Can I handle breach response internally to save money? Regulators and courts expect a documented, independent forensic investigation. Handling it internally creates conflicts of interest and will not satisfy most notification statutes or insurance policy conditions.
Are regulatory fines insurable? In many jurisdictions, yes. Some states prohibit insuring certain penalties. Your policy form's regulatory defense and penalty coverage section will specify what is and is not covered.
What is the average time to detect a breach? Small businesses take an average of 197 days to identify a breach, and another 69 days to contain it. That detection gap directly increases every cost category.
The Hidden Cost: Lost Contracts and Vendor Relationships
What a Policy Form Review Catches Before a Claim
The Bottom Line: Protecting Your Cash Flow
A ransomware crew encrypts your ERP system on a Tuesday. By Friday, a federal advisory links the crew to a foreign intelligence service. Your claim has not changed, but the language your carrier will read against it may have. That gap, between the event you experienced and the label someone else applies to it, is where war and hostile act exclusions in cyber insurance now decide outcomes.
Most buyers at companies with 10 to 500 employees never read the war exclusion. They read the declarations page, confirm the aggregate limit, and assume a cyberattack is a cyberattack. The form does not work that way. Since the London market rewrote its state-backed attack language, the exclusion has become one of the most consequential clauses in the policy. It is also one of the least understood.
We read these clauses for a living. What follows covers how the exclusions work after the state-backed attack endorsements, where the carve-backs sit, and how attribution drives disputes. It also covers what sublimits do to your real recovery and what you should ask before you bind.
The Evolution of Cyber War Exclusions
War exclusions were written for tanks, not code. The traditional clause, carried over from property forms, excluded loss from "war, invasion, acts of foreign enemies, hostilities or warlike operations." That language assumed a declared conflict, a physical theater, and an identifiable belligerent. None of those conditions map cleanly onto a malware strain that spreads from a compromised accounting software update to 60 countries in an afternoon.
NotPetya in 2017 exposed the problem. Pharmaceutical maker Merck sought recovery under its property program for losses tied to the attack, and its insurers invoked the hostile and warlike action exclusion. A New Jersey appellate court ruled in 2023 that the exclusion did not apply. The court reasoned that the language contemplated traditional military action, not an attack on a non-military company's computer systems. The parties later settled. Insurers took the lesson: old wording would not hold against cyber operations, so the wording had to change.
The change came in stages:
- 2017 to 2020: Carriers relied on legacy war language and "silent cyber" in property and casualty forms.
- 2021 to 2022: The Lloyd's Market Association published model clauses, and Lloyd's required managing agents to attach a state-backed cyberattack exclusion to standalone cyber policies starting in 2023.
- 2023 to 2025: Carriers adopted, modified, or wrote their own versions, producing inconsistent wording across the market.
- 2026: The market has standardized the LMA5567A and LMA5567B clauses to clarify how state-backed cyber operations are excluded or covered.
That last point matters for you. Standardization narrows the variation between forms, but it does not eliminate it. Your policy may carry an LMA clause, a modified version, or proprietary language that only resembles one.
Understanding State-Backed Attack Endorsements
A state-backed attack endorsement replaces the question "Was there a war?" with a different one: "Was this a cyber operation by or on behalf of a state?" That shift is the entire story. Under the modern framework, the exclusion can apply without any declared conflict, any troops, or any physical damage.
Most current endorsements break the exclusion into tiers. The first tier excludes loss from war itself, whether or not war is declared. The second tier excludes cyber operations carried out in the course of war. The third tier targets cyber operations outside a war that cause a "major detrimental impact" on a state. Modern clauses now trigger exclusions based on whether an operation "significantly impairs" a state's ability to function or its security capabilities. That language moves well beyond the traditional definition of a formal state of war.
The Role of Government Attribution
Attribution is the hinge. Most state-backed endorsements say the primary factor in deciding whether an operation is attributable to a state is whether the government of the state where your affected computer system sits has attributed it. For a US company, that usually means a federal attribution by the FBI, CISA, or another agency.
The catch is that governments attribute for their own reasons, on their own timeline. Analysts describe an "attribution paradox": formal attribution can trigger the exclusion, while a decision to withhold attribution for diplomatic reasons may leave the insurer responsible. Your recovery can turn on a foreign policy decision made in Washington. That decision has nothing to do with your controls, your incident response, or your claim.
If no government attribution exists, most clauses allow the insurer to rely on "objectively reasonable" inferences from available evidence. Read that phrase closely. It gives your carrier room to argue state involvement even when no agency has said anything publicly.
Standard vs. Modern Exclusion Language
The legacy clause asks whether hostilities or warlike operations occurred. The modern clause asks whether a state conducted the operation, whether the operation happened during war, and whether it impaired a state's essential functions. Those are three separate tests, each with its own definitions.
Here's what that means for you. Under legacy wording, your carrier carried the weight of proving a war-like event. Under modern wording, the carrier often needs only a qualifying attribution plus an impact on essential services. Compare the definitions section of your current form with the endorsement schedule. The exclusion that controls is frequently in the endorsement, not the base form.
Comparison of War Exclusion Frameworks
Four frameworks appear in the market. The table below reflects how they generally operate. Your actual form controls, and carriers modify these clauses regularly.
| Feature | Legacy War Exclusion | LMA5567A-Style | LMA5567B-Style | Proprietary Carrier Wording |
|---|---|---|---|---|
| Declared war required | Often implied | No | No | Varies |
| State-backed operations outside war | Unclear | Excluded if major impact | Excluded if major impact | Varies widely |
| Attribution standard | None defined | Government attribution, then reasonable inference | Government attribution, then reasonable inference | May be undefined |
| Collateral damage carve-back | No | Limited | Broader | Sometimes |
| Impacted state carve-back | No | Yes, in some versions | Yes, in some versions | Rare |
| Sublimit for carved-back loss | Not applicable | Often | Often | Common |
| Dispute risk for insureds | High (ambiguous) | Moderate | Moderate | High (untested) |
Two patterns stand out. First, the clearer the attribution mechanics, the more predictable the outcome, whether favorable or not. Second, proprietary wording carries the highest dispute risk because no court has interpreted it and no market body has explained it.
A manufacturer in Rochester with 120 employees and a single IT contractor should care less about which label the clause carries. It should care more about three questions. Who decides attribution? What does the policy do when no one attributes? Which carve-backs survive the exclusion? If your broker cannot answer those three questions from the form itself, you do not have an answer.
Navigating Carve-Backs for Cyber Operations
A carve-back restores coverage the exclusion would otherwise remove. In state-backed endorsements, carve-backs are where your negotiating room actually sits. The exclusion language is largely standardized. The carve-backs, sublimits, and definitions attached to them are not.
Carve-backs operate inside the exclusion, so they inherit its definitions. If the policy defines "essential service" broadly, a carve-back tied to that term narrows with it. Read the exclusion and the carve-back as one unit, never as separate clauses.
Coverage for State-Sponsored Espionage
Espionage is a common carve-back category. Many endorsements distinguish between operations that disrupt a state and operations that steal data. A state-sponsored group that exfiltrates customer records from a healthcare billing firm in Buffalo may not trigger the major-impact tier. That theft did not impair any state's essential functions.
In that scenario, a policy form may respond under its breach response and third-party liability insuring agreements, depending on how the endorsement is written. This matters for regulated sectors. A New York financial services firm subject to NYDFS Part 500 still faces notification duties, regulatory defense exposure, and potential penalties after an espionage incident, regardless of who sent the intruder. If your form excludes all state-backed operations without an espionage distinction, those costs may fall entirely on you.
The Collateral Damage Exception
Collateral damage carve-backs address the NotPetya problem: your company was never the target, but the malware reached you anyway. Some endorsements restore coverage for "bystander" losses where your systems sit outside the targeted state, or where the attack did not intend to affect you.
The definitions decide everything. Some clauses limit the carve-back to systems physically located outside the impacted state. Others require that the insured not be a contractor or supplier to an essential service. A software vendor serving a regional utility may lose the carve-back entirely because of that relationship.
Even when a carve-back applies, the money is limited. Many 2026 policies apply specific sublimits for claims involving state-sponsored actors, such as $250,000 on a $1 million policy, even when coverage carve-backs apply. Carriers use this structure deliberately.
It lets insurers offer some coverage while capping their maximum systemic exposure. For you, the result is simple: a $1 million policy may function as a $250,000 policy for exactly the scenario that worries you most.
Critical Infrastructure and Systemic Risk
Critical infrastructure is the reason these endorsements exist. Insurers fear correlated loss: one operation against a power grid, a payment network, or a cloud platform producing thousands of simultaneous claims. Most state-backed endorsements exclude loss arising from an operation's effect on essential services, including financial institutions, health services, utilities, and emergency services, even if your company was never targeted.
Consider a regional hospital network with 400 employees. A state-backed group disables the electrical utility serving its facilities. The hospital's systems fail, appointments cancel, and business interruption losses mount over 11 days. The hospital did nothing wrong, and its own network was never breached. Under many endorsements, that loss sits squarely inside the exclusion, because the triggering event was impairment of an essential service.
Four exposures deserve your attention:
- Dependent business interruption. Loss from a provider's outage may be excluded if the provider counts as infrastructure.
- Cloud concentration. Some endorsements treat major cloud and DNS providers as essential services. Others do not. The definition list decides it.
- Your own classification. If you supply or operate infrastructure, as a utility software vendor, a healthcare clearinghouse, or a payment processor, you may face the narrowest form of the exclusion.
- Contract requirements. Hospitals, municipalities, and banks often require vendors to carry cyber limits with no war sublimit. Audit those contracts against your endorsement schedule.
The protection gap compounds the problem. One major reinsurer reports that only 47% of eligible organizations globally carry standalone cyber insurance. Many of the companies that do carry it hold forms with state-backed exclusions they have never reviewed.
Managing Coverage Disputes and Proof Requirements
War exclusion disputes are rarely about whether an attack happened. They are about who did it, what it affected, and who has to prove each fact. Those questions determine whether you recover, how much you recover, and how long it takes.
Burdens of Proof in Cyber Attribution
Under general insurance law in most states, including New York, the insured proves the loss falls within the coverage grant. The insurer then proves an exclusion applies. If the insurer meets that burden, the insured must prove a carve-back restores coverage. That order matters.
State-backed endorsements shift the practical weight. When a government attribution exists, the insurer's burden becomes much easier to meet. You may then need forensic evidence that the operation did not hit an essential service, or that your systems qualify for the collateral damage exception. That evidence comes from your incident response firm's report. If the report speculates about nation-state actors without support, it can become the carrier's strongest exhibit.
Take three steps before any incident occurs:
- Confirm your forensic vendor understands that its attribution language may affect coverage.
- Route forensic engagements through counsel to preserve privilege where state law allows.
- Request the policy's dispute resolution clause and note whether it requires arbitration, which venue governs, and any deadlines.
The Impact of Recent Court Rulings
The New Jersey appellate decision in Merck's NotPetya case remains the most cited ruling. It held that legacy hostile-action language did not reach a cyberattack on a private company. A separate NotPetya dispute involving food maker Mondelez settled in 2022 before trial, leaving no ruling on the merits.
The limitation is clear: those cases interpreted legacy wording. No appellate court has yet tested the modern state-backed endorsements at scale. Courts still apply contra proferentem in many jurisdictions, construing ambiguous exclusions against the drafter. Carriers drafted the new clauses specifically to remove that ambiguity. Do not assume your policy will benefit from the Merck reasoning. The form you hold today was written to defeat it.
Common Questions About Cyber War Clauses
Does my cyber policy cover attacks from foreign hackers? It depends on the endorsement. Many policies may respond to criminal attacks from foreign actors, but state-backed operations can trigger the exclusion depending on attribution and impact.
Who decides if an attack was state-backed? Most modern clauses look first to attribution by the government where your affected systems sit. Without one, the insurer may rely on reasonable inferences from available evidence.
What happens if the government never attributes the attack? The carrier may still argue state involvement using forensic evidence. That creates uncertainty, which is why the inference standard in your form deserves review.
Is a ransomware group linked to a foreign government considered state-backed? Possibly. If a government attributes the operation to a state or its agents, the exclusion can apply even if the group also profits financially.
Can I buy back coverage for state-sponsored attacks? Some forms allow broader carve-backs or higher sublimits for an additional premium. Availability varies by carrier, industry, and your security controls.
Does a war sublimit reduce my total policy limit? Usually the sublimit sits inside the aggregate limit and does not add to it. A $250,000 war sublimit on a $1 million policy caps that category of loss at $250,000.
Should my vendor contracts address war exclusions? Yes. Confirm whether your clients require cyber limits without state-backed sublimits, and whether your vendors' policies carry exclusions that could leave you absorbing their losses.
What This Means for Your Business
These exclusions are no longer boilerplate. Attribution standards, carve-back definitions, and sublimits now decide whether a nation-state incident costs you a retention or a seven-figure loss. The brochure says "cyber coverage." The endorsement says what that coverage excludes when a government points to a foreign intelligence service.
Start with three tasks this quarter. Pull your endorsement schedule and identify the exact state-backed clause attached. Compare your war sublimit against the contractual limits your clients require. Then stress-test your retention and any sublimited recovery against cash flow for a 30-day outage.
Bloc Cyber places cyber liability insurance by form, not by bundle. That means reviewing the exclusion, the carve-backs, and the sublimits before you bind. If you want a specialist to read your current policy form with you and show where the coverage grant stops, request a coverage review. We'll walk through the language line by line, with no pricing promises and no guarantees about what any form will pay. The clause already exists in your policy. The question is whether you read it before a claim does.
ABOUT THE AUTHOR
Caden Braly
— Founder, Bloc Cyber
I'm Caden Braly, founder of Bloc Cyber, the specialty cyber insurance arm of Braly Insurance. I built Bloc Cyber around one idea: businesses deserve coverage that actually responds when a cyberattack happens. I work closely with clients to understand their exposure, place the right policy through specialty carriers, and stand with them through the claim. My goal is simple — give every business straight answers and protection they can trust.
Full profile → caden@bloccyber.com LinkedIn
Recent Posts
