Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Cyber Insurance Exclusions
Transcript
- Lucas: So there's this quietly terrifying clause buried in almost every enterprise cyber insurance policy these days, and it basically says: if the attack was carried out by, or on behalf of, a nation-state, you're not covered. Luna: Right — the 'war exclusion.' And the thing is, attribution is never clean. So insurers get to say 'that looks state-sponsored, we're out,' and the company is left holding the bag. Lucas: Exactly. And the catalyst for this becoming standard language was a 2018 case that took years to shake out: the Merck pharmaceutical company was hit by the NotPetya malware, which caused over a billion dollars in losses. Merck had a 'hostile acts' exclusion in its policy, but they argued that NotPetya wasn't an act of war — it was a criminal attack. Luna: And the courts ultimately sided with the insurers. That set a precedent that a state-sponsored cyberattack can be treated as a hostile act, even if no formal war declaration exists. Lucas: Right. And since then, most policies have explicitly carved out 'state-sponsored' or 'nation-state' attacks. The problem is, the line between a criminal group and a state actor is blurry. Many advanced persistent threat groups operate with government backing but plausible deniability. Luna: So the security team can't just rely on insurance as a safety net. They have to assume that the most sophisticated attacks — the ones that could actually cripple the company — might not be reimbursed. Lucas: Which changes the whole calculus of risk management. A few years ago, a CISO could say 'we have cyber coverage for up to fifty million dollars,' and the board would nod. Now the board should be asking 'what happens if the insurer denies the claim?' Luna: And the answer is often: the company self-insures, or it absorbs the loss. That's a tough conversation. Lucas: So what are security teams actually doing about it? I've seen three main strategies emerge. First, they're investing heavily in resilience — making sure they can recover operations without an insurance payout. That means offline backups, redundant systems, and incident response retainer agreements that are paid upfront, not tied to insurance. Luna: Second, they're getting lawyers involved at the policy negotiation stage. They want the 'state-sponsored' language to be as narrow as possible — requiring explicit attribution by a named government agency before the exclusion kicks in. Lucas: And third — and this is the interesting one — some large enterprises are creating internal 'cyber captives.' That's a subsidiary insurance company that the parent company owns, which specifically covers cyber risk. It's a form of self-insurance that can be tax-advantaged. Luna: Right, but that only works for the very largest firms. For a mid-size company with a hundred million in revenue, setting up a captive is too expensive and complex. Lucas: True. And that's where the market is really feeling the squeeze. Mid-market companies are seeing premiums rise and coverage shrink. So they're having to make hard choices about which risks to accept. Luna: It's almost like the insurance industry is forcing companies to become more rigorous about their own security posture — but the mechanism is kind of brutal. Lucas: It is. And it raises a deeper question: if the insurance safety net has big holes in it, does the whole concept of cyber risk transfer break down? I mean, we buy insurance so we can sleep at night. If the policy doesn't cover the most dangerous events, what are we paying for? Luna: You're paying for the smaller, less sophisticated attacks. Ransomware from a known criminal group that isn't clearly state-backed. Data breaches from employee mistakes. Those still get covered. The problem is the tail risk. Lucas: And the tail risk is where the existential threats live. So security teams have to build for the tail, not just the average. That's a mindset shift. Luna: It's also a budgeting shift. Instead of spending most of the security budget on tools that reduce the likelihood of a minor incident, you allocate more to recovery capabilities that kick in after a major one. Lucas: Exactly. And the tools for that are things like immutable backups, isolated recovery environments, and extensive tabletop exercises that assume no insurance payout. Luna: I was reading a survey from earlier this year — I think it was from the Cyber Risk Alliance — and it said about forty percent of enterprises now run at least one exercise per year where the scenario is explicitly a state-sponsored attack with denied insurance. Lucas: That's smart. And it forces the board to confront the worst-case scenario directly. Because if you can show them that the company can survive a hundred million dollar loss without insurance, then the insurance becomes a nice to have rather than a necessity. Luna: But for a company that can't afford that level of resilience, the gap is scary. And that's where some policymakers are starting to talk about a government backstop — like a cyber version of the terrorism risk insurance program. Lucas: Yeah, there's been chatter about that in D.C., but nothing concrete yet. And even if it happens, it would likely only cover critical infrastructure. The average retailer or manufacturer would still be on their own. Luna: So what's the single most important thing a security team can do today, given this landscape? If you had to pick one action. Lucas: I'd say: read your policy's exclusion language with a lawyer who specializes in cyber, and then adjust your incident response plan accordingly. Assume the worst attack will be excluded. Build your recovery plan on that assumption. Luna: That's practical. And it's something a lot of teams haven't done yet. Lucas: And you know, talking about these kinds of real-world operational challenges — that's why we keep doing this show. We deliberately don't run ads on these episodes. If you find the conversation useful for what you're building or running, and you want to support that choice, the link is buy me a coffee dot com slash fexingo. Luna: Yeah, listener support is what keeps it ad-free. It's a small way to help us keep going. Lucas: So back to the insurance piece — one nuance I think is important: some policies have a 'grey zone' clause that covers attacks that can't be confidently attributed. That's worth negotiating for. Because attribution often takes months, if it ever happens. Luna: Right, and by then the company has already had to pay for recovery out of pocket. A grey zone clause can buy time. Lucas: Exactly. And it reduces the incentive for the insurer to fight attribution. Because if they deny a claim based on 'state-sponsored' but later it turns out to be a criminal group, they could face bad faith litigation. Luna: So the legal landscape is still evolving. There haven't been many court cases since Merck. But the language is getting more specific each renewal cycle. Lucas: One more thing: there's a growing trend of requiring 'cyber hygiene' attestations as a condition of coverage. Insurers want proof that you have multi-factor authentication, endpoint detection, and patching processes in place before they'll even quote. Luna: That's actually a positive development — it aligns incentives. But it also means that if you have a gap, you either fix it or you pay a huge premium. Lucas: Right. So the insurance market is becoming a de facto regulator of security practices. Which is ironic, because the same policies then deny the biggest claims. Luna: It's a weird dynamic. But I think the takeaway is clear: don't bank on insurance. Bank on being able to operate through a major attack. Lucas: That's the bottom line. Build for the worst, and treat insurance as a bonus, not a foundation.