A property policy drafted before cyber became a subject does not mention cyber. It does not include it, it does not exclude it, it says nothing about it. The market calls this silent cyber, and the phrase is misleading on one point: silence is not a neutral position, it is a position nobody deliberated and whose scope will be decided later, by a court, on words written for something else. An insurer that has said nothing has not kept its options open, it has handed them to a third party.
The distinction everything else rests on must be stated first. A cover is affirmative where the contract names cyber risk and says what it does with it, whether it covers it or excludes it: either way, one knows. It is silent where the contract does not name it and the question whether it responds depends entirely on how general clauses will be read, a definition of physical damage, an inherited war exclusion, a condition of cover on property. The word silent therefore does not describe an absence of cover, it describes an uncertainty about cover.
That uncertainty has two opposite consequences and they must be held together, because most accounts keep only one. On the insurer's side it is an unpriced exposure: a premium was calculated on a loss history that did not include this risk, and the contract might nonetheless have to answer for it. On the insured's side it is an unreliable cover: it may believe itself covered and will discover at the loss that it has to litigate to be, which is not the same thing as being insured. Nobody gains from this situation, and that is why the market addressed it.
One must then understand why silent cyber is a different, and worse, problem than a simply mis-assessed exposure. A mis-assessed exposure is corrected at the next renewal, once measured. This one is not measured, because it appears in no system: it is spread across property, marine, liability and crime policies, none of which carries a cyber code. An insurer can therefore measure its affirmative cyber aggregation very precisely and be wholly ignorant of the second, and both would crystallize at once, on the same event, in two lines that do not talk to each other.
Invisibility is in fact the true defect, more than the absence of premium, and a comparison shows it. An insurer that knew it carried an unpriced exposure of twenty million could decide to keep it, reinsure it or withdraw from it: that would be a decision. An insurer that does not know it carries it has none of those three options, and its reinsurance was bought on a figure that ignored it. The same reasoning holds for the client: a company that knows part of its cyber risk is covered only by a silent policy can make a trade-off; a company that does not has a hole in its program and believes it has a program.
Finally, what the silence is not must be said, because two confusions circulate. Silent cyber is not a drafting error someone committed: most of these policies were written correctly, at a time when the risk did not exist in this form, and reproaching them in hindsight teaches nothing. Nor is it an old phenomenon on its way out: every time a new risk appears without contracts naming it, the same mechanism restarts, and cyber is only the best-documented example of a family of problems that will recur.
The useful lesson is therefore a question to put to every policy in a program, and it takes a minute per contract. Does this contract name cyber risk. If so, does it say it covers it, excludes it, or excludes it with exceptions. If not, cover for that risk depends on an interpretation, and that interpretation is an uncertainty belonging to somebody. Knowing to whom it belongs, on each line of the program, is exactly what the following lessons serve to establish.
An electronic component maker suffers ransomware on March 3 that encrypts its office network and, as a side effect, stops supervision of two production lines for eleven days. Losses break down as follows: 410,000 euros of response costs and data reinstatement, 1.9 million euros of margin lost on the production stoppage, and 220,000 euros of components scrapped because two furnaces drifted while supervision was down. The company holds a cyber policy with a 2 million euro limit, placed in 2024, and a property and business interruption policy of 40 million, renewed without redrafting since 2016, which nowhere mentions the word cyber. The finance director asks which policy to notify. What should he be told?
The answer is not to choose a policy, it is to notify both and to know why. The undisputed share is the first: 410,000 euros of response and reinstatement costs fall under the affirmative cyber policy, which names them, and nothing in the property policy purports to answer for them. The other two shares are where the silence is paid for. The 1.9 million of lost margin is claimed on the cyber policy, within a 2 million limit of which 410,000 is already consumed, leaving 1.59 million available and therefore a shortfall of 310,000 euros on that share alone. The property policy covers business interruption up to 40 million, but its trigger presupposes physical damage, and encryption of data is not that in the sense those contracts intended in 2016: the question is open, it depends on the definition applied, and that is exactly what the word silent designates. The 220,000 euros of scrapped components is more interesting still, because it is the share that most resembles conventional physical damage: material spoiled by furnace drift. A property policy written in 2016 may well answer for it without ever having intended to cover ransomware, and that is silent cyber in its purest form. Three practical consequences follow. First, notify both insurers without delay, since time lost on the property policy is not recovered and the insured does not have to settle a question of interpretation itself. Second, have the adjuster produce a breakdown of the 220,000 euros separating physically altered material from lost data, because that breakdown will decide it. Third, note for the future that the company does not hold a 42 million program against this risk: it holds 2 million that is certain and 40 million whose application depends on a reading, which is not the same thing and is not something to discover at the loss.
- 01Silence is not a neutral position: it is a position nobody deliberated and that a court will settle on words written for something else.
- 02Affirmative means the contract names cyber and says what it does with it, cover or exclusion; silent means the answer depends on a reading.
- 03The insurer sees an unpriced exposure, the insured an unreliable cover, and both are right at the same time.
- 04Invisibility is the true defect, more than the absence of premium: an exposure you do not know you carry can be neither kept, reinsured, nor exited.
- 05This is not an old drafting fault on its way out: the mechanism restarts with every new risk contracts do not yet name.