War exclusions protect insurers as cyber spillover risk emerges

As geopolitical tensions intensify, concerns are resurfacing about cyber activity being used as a tool of conflict, and whether UK businesses could face spillover exposure.

“Arguably it’s going to be an uptick,” said George Grimshaw (pictured), divisional head of cyber & technology at Clear Group, adding that any widening conflict could bring a corresponding rise in cyber activity affecting UK firms.

“That is the unfortunate byproduct of war in these territories and cyber warfare being employed.”

Grimshaw warned that spillover could take multiple forms: “Whether that’s through ransomware attacks, attacking infrastructure, attacking critical infrastructure manufacturing across the country. We’ll probably see some incidents of that over the next few weeks as the conflict unfolds.”

War exclusions reshape cyber coverage

The market’s position on war-related cyber losses has hardened in recent years, particularly within the Lloyd’s market.

“Cyber insurance is not going to cover anything when it comes to war or state-backed attacks,” Grimshaw said. “But that’s not to say insurers are not here to help insureds.”

The move followed wider discussions among underwriters about aggregation risk and systemic exposure.

“There used to be coverage for war in some of these policies prior to this, but Lloyd’s have had that discussion and decided there should be a blanket exclusion when it comes to war exclusions.”

Better protected market, more exposed clients

The move towards blanket war exclusions has altered the balance of risk within cyber policies, particularly for organisations operating close to government or critical infrastructure.

“In terms of clients, it leaves them in a more vulnerable position in situations like this, when they can suffer from a cyber-attack or a state backed cyberattack, especially if they’re more in the public sector or government, or have any sort of government dealings,” he said.

While that shift may narrow recovery in certain scenarios, Grimshaw said the intention was to reduce systemic exposure across the market.

“Having that war exclusion in place clarifies where coverage is applicable, but also protects the market itself from systemic loss,” he said.

He added that state-linked cyber capabilities have developed significantly in parts of the Middle East, reinforcing why the industry has sought clearer boundaries around war-related cyber events.

As geopolitical conflict increasingly extends into digital domains, the dividing line between insured cyber loss and excluded state-backed activity may become more than a technical wording issue. It could shape how exposed UK businesses ultimately prove to be.