Knowing that a policy can be silent is of no use until one can determine whether one's own is. It is a reading exercise, it takes a few minutes per contract, and it consists in sorting each policy into one of three families. The difficulty is not scarcity of information: it is that the clauses concerned carry similar headings, look alike, and differ on three or four words that decide everything. A professional who reads a clause heading and believes to know what it does will be wrong regularly.
The first family is the plain exclusion. The contract excludes loss resulting from a cyber act, without exception, and the position is explicit: this risk is not here, it is elsewhere or nowhere. It is the easiest family to read and the easiest to misjudge, because a plain exclusion is not bad news in itself. In a program where an affirmative cyber policy carries the risk, it avoids two overlapping covers, the discussions between insurers and the settlement delays that come with them.
The second family is the exclusion with write-back, and it demands the most attention. The contract excludes cyber risk, then gives cover back for certain named cases: physical damage resulting from fire or explosion consequent on a cyber act, for instance. The useful reading is not the write-back itself, it is its complement: whatever the write-back does not cite stays excluded. A write-back limited to fire and explosion therefore leaves out a production stoppage with no physical damage, which is the commonest scenario in most industries.
The third family is affirmative cover, where the non-cyber contract explicitly grants something in respect of cyber, almost always with a sub-limit and often with its own deductible. It is the least frequent and the most convenient, because it turns a question of interpretation into a question of amount. Three things must then be read and not one: the size of the sub-limit, its position relative to the main limit, and how it articulates with the same insured's affirmative cyber policy, which it may duplicate or complete depending on the order-of-settlement clauses.
One must then know where to look, since these clauses do not always live where expected. A position on cyber may be written into the general exclusions, into an additional clause appended to the schedule, into the definition of physical damage, or into a condition of cover bearing on information systems. The definition of physical damage is the most effective hiding place: a contract defining physical damage as harm to the substance of tangible property has settled the question of data encryption without ever writing the word cyber, and that sentence sits at the front of the contract, where nobody rereads.
Four words deserve particular attention when one of them appears, because they shift the boundary more than the rest of the sentence. The word data, according to whether it is treated as insurable property, decides half the cases. The word consequent, tying physical damage to a cyber act, decides the other half. The word malicious, where it qualifies the act aimed at, leaves out human error and failure, which are nonetheless frequent causes of stoppage. And the expression cyber act, if defined in the contract, must be read in its definition and not in its ordinary sense.
The method therefore comes to four questions, put in this order to each non-cyber contract in the program. Does the word cyber, or a definition standing for it, appear anywhere. If so, to which of the three families does the clause belong. If it is a write-back, what does it leave out, written as one sentence rather than by quoting the clause. And if the word appears nowhere, does the definition of physical damage settle the question without saying so. The result of those four questions fits on one line per contract, and that line is what the last lesson of this course assembles.
A building materials maker receives three quotations from its broker for its property and business interruption policy, limit 60 million euros. Quotation A excludes loss resulting from a cyber act, without exception. Quotation B excludes loss resulting from a malicious cyber act, writing back physical damage and the business interruption flowing from it where it results from consequent fire, explosion or water damage. Quotation C nowhere mentions cyber, but defines physical damage as "any physical harm to the substance of insured tangible property". The company also holds an affirmative cyber policy of 5 million. Its feared scenario is a three-week stoppage of its two furnaces following ransomware, with no physical damage at all, put at 12 million of lost margin. Which of the three responds to that scenario?
None of the three, and that result must be established before prices are discussed, because it changes the question put to the market. Quotation A excludes it explicitly, without ambiguity, and reading it takes ten seconds. Quotation B is the misleading one, and it deserves to be read backwards: the write-back cites fire, explosion and water damage, and the feared scenario involves none of them; whatever the write-back does not cite stays excluded, so a furnace stoppage without physical damage stays out. The word malicious adds a second effect, in the other direction and often unnoticed: a failure or human error would not be a malicious act, therefore not excluded by that clause, which widens cover on a scenario the company has not named. Quotation C is the most interesting and the most dangerous to misread, because it looks silent and is not: by defining physical damage as physical harm to the substance of tangible property, it settles the fate of data encryption without writing the word cyber, and a production stoppage with no physical harm does not cross the trigger. Its position is therefore explicit in substance and implicit in form, which is exactly the hiding place described in the lesson. That leaves the affirmative cyber policy of 5 million, alone in responding to the scenario, and it leaves 7 million with the company out of the 12 expected. Two consequences follow, and the second matters more than the first. The first is that the choice between A, B and C must not be made on cyber, since none covers it on the feared scenario; it is made on everything else, and A's clarity has a value of its own. The second is that the subject to take to market is not the property policy, it is the cyber policy's limit, and having established that by reading rather than by a loss is the whole benefit of this lesson.
- 01Three families and three only: plain exclusion, exclusion with write-back, sub-limited affirmative cover.
- 02On a write-back, what matters is not what it cites but its complement: whatever it does not cite stays excluded.
- 03A plain exclusion is not bad news where an affirmative cyber policy carries the risk: it avoids overlap and delay.
- 04The definition of physical damage is the most effective hiding place: it settles the fate of data without ever writing the word cyber.
- 05Four words shift the boundary more than the rest of the sentence: data, consequent, malicious, and the definition of cyber act where one exists.