War exclusions in cyber insurance: What the Russia-Ukraine conflict changed for policyholders

When the Russia-Ukraine conflict escalated in early 2022, it forced a reckoning that the cyber insurance market had been postponing for years: what happens when a cyberattack is tied to a state or a war? The question had been theoretical for so long that most policies addressed it only through standard, and often vague, war exclusions written for a physical-world era. In 2022, the ambiguity became a live problem. Carriers, brokers, and policyholders suddenly had to confront what war exclusions actually meant for cyber coverage, and the conversation changed the market in ways that are still unfolding.

The NotPetya question finally got answered

The tension had been building since at least 2017, when the NotPetya malware, widely attributed to a state actor but spread through a commercial software update, caused billions in damage worldwide. Insurers disputed coverage by invoking war exclusion clauses, arguing the attack was an act of war. The dispute took years to resolve and exposed how poorly traditional war exclusions fit a world where attacks are carried out by state-aligned actors but inflict damage on private companies in unrelated countries. In 2022, with a real armed conflict underway and cyber operations visibly tied to it, the question stopped being academic.

Why attribution made things messy

The core problem was attribution. War exclusions traditionally hinge on identifying a nation-state as the actor. But in cyberspace, attribution is slow, uncertain, and often never officially confirmed. An attack might be carried out by a criminal group loosely aligned with a government, or by patriotic hackers acting independently. It might use infrastructure that points in multiple directions at once. Requiring a policyholder to prove that an attack was or was not an act of war, before coverage kicks in, is a burden that few organizations are equipped to meet. This ambiguity became a central source of anxiety in 2022.

Carriers moved to clarify the language

In response to the conflict, major insurance markets began tightening and clarifying war exclusion language in cyber policies. The most significant move came from Lloyd's of London, which announced that from 2023, standalone cyber policies would need to clearly exclude losses arising from state-backed cyberattacks, whether or not war was formally declared. Other carriers followed with similar clarifications. The intent was to draw a brighter line around catastrophic, systemic state-driven risk, which no single insurer could reasonably price. But the practical effect was to shift more of that risk back onto policyholders, who now needed to understand exactly what their policy did and did not cover.

What the new exclusions actually exclude

The revised language generally excludes losses caused by cyber operations attributable to a state, or conducted on a state's behalf, in connection with a war or similar conflict. In practice, this means an organization hit by a state-directed attack during a geopolitical conflict may find its claim denied. The challenge is that the exclusions still rely on attribution, and the boundary between state activity and criminal activity remains blurry. Many organizations discovered in 2022 that the fine print of their policy, which they had never read closely, contained exclusions that materially narrowed what they thought they were buying.

What this means for security strategy

The most important lesson of 2022 was that cyber insurance is not a substitute for security. Coverage can be denied precisely when risks are most severe, which is during a state-backed campaign or a period of elevated geopolitical tension. Organizations that had treated insurance as their primary risk transfer mechanism realized they needed to invest more heavily in prevention and resilience: multi-factor authentication, patching, backups, incident response, and a trained workforce. The conflict reinforced the standing advice that insurance should be one layer in a defense, not the whole plan.

Where training fits in a harder world

Even as war exclusions narrowed coverage, the fundamentals of reducing cyber risk did not change. Most incidents still begin with human error, and a trained workforce remains one of the most effective ways to prevent the phishing, credential theft, and social engineering that lead to breaches. The geopolitical environment of 2022 made it more important, not less, for employees to understand the threat landscape and to follow verification procedures. Organizations that maintained strong security awareness programs were better positioned to weather both the direct threats of the conflict and the harder insurance market it helped create.

The lasting shift

The war exclusion debate did not end in 2022, and the language in cyber policies will keep evolving. But the episode forced a maturity in how organizations think about cyber insurance. Policyholders now read their exclusions more carefully, understand that coverage has real limits, and recognize that the best protection is a strong security program that reduces the likelihood of an incident in the first place. The conflict was a reminder that in cybersecurity, as in insurance, the cheapest claim is the one you never have to file.