Silent cyber was not born of a decision, it was born of a gap between the speed of contracts and the speed of risks. Property policies renew by carrying their wording forward, sometimes for twenty years, because stable wording is a virtue: it yields case law, settlement habits and possible comparisons. That virtue becomes a defect the day a risk appears that did not exist when the words were chosen. The history that follows reads as fact, not as a reproach addressed to anyone.
The event that made the subject visible is the NotPetya attack of June 2017. Destructive software spread through a Ukrainian accounting update propagated worldwide within hours and stopped industrial, logistics and pharmaceutical companies with no connection to Ukraine. Many of those companies held a small or non-existent cyber policy and a considerable property policy. They therefore claimed on the second, which did not mention cyber, and several insurers raised the inherited war exclusion, relying on the state attributions pronounced by governments in 2018.
The litigation that followed deserves to be known for what it established rather than for its outcome. The case of Mondelez against Zurich and that of Merck against its insurers turned on the same question: does a war exclusion written for armed conflict apply to a cyberattack attributed to a state. Mondelez settled in 2022, during trial, without a judgment on the merits. Merck alone was decided, and for the insured, the 2023 decision holding that the inherited wording aimed at war in the ordinary sense, before it too settled. What matters is not who won: it is that the burden of the uncertainty fell on the insurer, because an exclusion is a defense and the party raising it carries the demonstration.
The market's reaction followed two parallel routes, and it is useful to distinguish them because they do not carry the same force. The first came from supervisors, who asked insurers to identify their non-affirmative cyber exposure, quantify it and say how they intended to treat it, without imposing a solution. The second came from the market itself, in the form of standardized clauses meant to be inserted into non-cyber policies so as to write down at last what they do with the risk. The first created the obligation to look, the second supplied the words.
It must be added that clarification did not mean exclusion, and that is the commonest misreading of the period. Making a policy explicit can mean excluding, excluding while writing certain cases back in, or covering affirmatively with a sub-limit. All three outcomes exist in the market and are met within the same programs. A professional who hears clarification and automatically understands exclusion will be wrong about half the contracts read, and will forgo an argument in the cases where the policy genuinely grants something.
The result, a decade on, is a two-speed market that has to be recognized. Large property and marine policies placed in the markets that circulated those clauses today carry an explicit position, and the question of silence there is only a reading exercise. Mid-sized policies, local contracts, liability covers and ancillary extensions carry it far less, because standardization spread from the top down. The silence has therefore not disappeared: it has moved to the contracts nobody rereads.
The lesson to take from this history goes beyond cyber, and it is what justifies telling it in a course. A new risk does not wait for contracts to name it, the burden of ambiguity ends up with the party invoking a clause in its defense, and supervisors intervene by asking for measurement before asking for correction. Those three regularities held for cyber and will hold for the next one. A professional who has seen them once recognizes the situation when it recurs, which is exactly what a course can transmit and a clause cannot.
A mid-sized food group has its insurance program reviewed in January. Three contracts are examined. The property and business interruption policy, placed in the London market, has since 2021 carried a cyber exclusion with a write-back for physical damage resulting from fire or explosion consequent on a cyber act. The general liability policy, placed with a national insurer, nowhere mentions cyber and has not been redrafted since 2015. The cargo policy, placed locally, carries a cyber exclusion with no write-back at all, inserted in 2023. The broker tells the risk manager that the program is now clarified on cyber. Is the broker right, and what should be done?
The broker is right about two contracts and wrong about the one that matters most, and the error committed is the one this lesson targets: confusing clarification with uniform treatment. The property policy is indeed clear, and it is even the best of the three cases, because it excludes while writing back: physical damage resulting from fire or explosion consequent on a cyber act stays covered, which is a partial affirmative cover and not a refusal. One must still read what the write-back does not cover, namely a production stoppage without fire or explosion, which is by far the likeliest scenario in a food plant. The cargo policy is clear too, in the other direction: exclusion with no write-back since 2023, therefore an explicit position, and the subject is closed unless one wants to renegotiate it. The general liability policy is the real subject, and the broker counted it as clarified when it is exactly the opposite: nothing on cyber, no redrafting since 2015, that is, a silent policy in the full sense. It illustrates the displacement described above: standardization spread through the large policies placed in London, and it did not reach a liability contract placed with a national insurer. Three steps follow. Tell the risk manager the program carries two explicit positions and one uncertainty, and that the uncertainty sits on the line that would answer a third-party claim after a data breach. Do not ask for an exclusion on that policy, which would turn an uncertainty into a certain absence of cover, but ask the insurer to write down its position, whatever it is, since knowing it allows a trade-off. And note that the word clarified, applied to a whole program, means nothing: it is verified contract by contract, a minute each.
- 01Silent cyber comes from a difference in speed: stable wording is a virtue, until a risk appears that its words did not anticipate.
- 02NotPetya in 2017 made the subject visible because companies claimed on property policies that did not mention cyber.
- 03What the litigation established is not who wins, it is that the burden of ambiguity falls on the party raising an exclusion in its defense.
- 04Clarifying does not mean excluding: exclusion, exclusion with write-back and sub-limited affirmative cover coexist in the same programs.
- 05The silence has not gone, it has moved to the mid-sized and local contracts that top-down standardization never reached.