In an ordinary information system, an attack destroys data and halts an activity, but nothing breaks physically. In an industrial system, the same attack commands actuators, valves, circuit breakers, and it can therefore break something. That difference, which looks technical at first, actually decides which contract responds, which book carries the loss, and consequently which treaty receives it. It is settled by a physical fact that no clause contains and that a forensic examination will establish weeks later, while the choice of line is made in the first few days.
The reason lies in how the two contracts are built. A property policy triggers on physical damage to insured property, and its business interruption cover is attached to that damage: it indemnifies the shutdown flowing from the damage. A standalone cyber policy triggers on a security event and carries a business interruption cover that needs no physical damage at all. On an industrial attack, the shutdown is the same, the duration is the same, the workforce is idled the same way, and yet two different contracts may take it on depending on whether metal gave way.
The most counterintuitive consequence is that a more severe attack can be better covered than a less severe one. If a pump is destroyed, the property policy opens, and with it a business interruption cover that is often broad, calibrated on conventional industrial losses. If the same attack merely halts the line without destroying anything, only the cyber policy remains, whose amounts are frequently of another order. Physical severity and breadth of cover therefore do not move in the same direction, which offends everyone's intuition, including that of the underwriter who placed both contracts.
The reverse effect exists and is more dangerous, because it produces a hole rather than a surplus. Since the affirmation movement, many property policies carry a cyber exclusion, and many cyber policies exclude physical damage to property. Between those two exclusions lies a seam, and industrial cyber sits exactly on it. An insured holding both contracts can find itself uncovered precisely because it bought both, each pointing at the other for the loss the other excludes. The seam is visible only by reading both texts side by side, which nobody does at placement since the two contracts are negotiated by different teams.
Then comes the aggregation consequence, and that is the one a reinsurer cares about. A single industrial attack accumulates simultaneously in the property book and in the cyber book. Yet the cyber book's aggregation study sees only its half, and the property book's study only its own. The two books have different event definitions, different aggregation clauses, often different reinsurers, and nobody computes the sum because no tool is built to compute it. Silent cyber is not merely an unpriced exposure: it is an invisible accumulation running across lines, and the invisibility is the real defect, more so than the missing premium.
A proof problem compounds everything else. Establishing that physical damage was indeed caused by the attack requires forensics on industrial systems whose life cycles run fifteen to thirty years, designed for isolated networks and devoid of serious logging. The evidence that decides the line is therefore precisely the evidence most likely not to exist. And an operator's first reflex, restarting production, destroys whatever remained: the pump is replaced, the controller is reset, and the trace leaves with them.
One conclusion follows that moves the subject outside contract law. The line that will carry an industrial cyber loss is decided by material gathered in the first hours, by people whose job is to get the plant running rather than to preserve a file. In other words, the allocation between the property policy and the cyber policy is settled in the incident response plan, months before any adjuster opens a contract. It is a claim that holds up in practice: an operator who planned to photograph, timestamp and isolate before restarting keeps the choice; one who did not has it dictated by the absence of evidence.
A chemicals producer runs a line driven by a SCADA system. On March 12 at 03:00, an attacker reaches the SCADA from the office network and alters the setpoints of several valves. A reactor batch is lost and a pump is destroyed by cavitation. Production stops for nineteen days. Physical damage is assessed at 0.4 million euros, business interruption at 14 million. The group holds two contracts: a 2023 property policy, whose business interruption flows from covered physical damage, and which carries a cyber exclusion with a write-back for ensuing physical damage; and a 2025 standalone cyber policy, covering business interruption after a security event but excluding physical damage to property. The group presents the entire loss under the cyber policy, on the grounds that this was a cyberattack.
Presenting the loss under the cyber policy because the cause is cyber is the mistake, and it is the one a competent professional makes, because it is logical. You do not route by cause, you route by consequence, and the two contracts were drafted to meet at exactly that point. The write-back for ensuing physical damage reopens the property policy on the pump and the lost batch, and the business interruption flowing from that damage follows the same policy. The cyber policy, for its part, excludes physical damage, so the 0.4 million is not there, and its business interruption cover responds to the system outage. The same 14 million is therefore claimable under two contracts on two different theories, and the split turns on a question that is not legal at all: would the plant have stayed down nineteen days from the SCADA outage alone, or was the pump's lead time the critical path? If the plant could have restarted in three days and the pump imposed sixteen, then three days belong to cyber and sixteen to property. The whole file rests on a pump manufacturing lead time, and no clause says so. The trap in the group's approach lies elsewhere and it is lasting: presenting first under the cyber policy extinguishes nothing on the property side, but installs in the adjuster's mind a causation narrative centered on the outage, which then has to be undone. Meanwhile both insurers cede into two books with different aggregation clauses, so that each reinsurer sees only a fraction of a single event.
- 01An industrial cyber loss is routed by consequence, not by cause: the question is whether property was physically damaged.
- 02An attack that breaks something can open a broader cover than one that merely halts the line: severity and breadth of cover do not move in the same direction.
- 03Between a property policy's cyber exclusion and a cyber policy's physical damage exclusion lies a seam, and industrial cyber sits on it.
- 04A single industrial attack accumulates in two books at once, and neither aggregation study sees the other half.
- 05The evidence that decides the line is destroyed by the restart: allocation is settled in the incident response plan, not in the contract.