Algo · πόλις
The name of this house does not string together two fashionable words. It names two risks: cyber risk, which can be modeled, and political risk, which has to be judged. And where its two roots meet, it says why one underwriter should hold both.
Two roots
Computation, modeling, artificial intelligence: the tooling that lets a single underwriter hold a portfolio that used to need a team. Cyber risk is the natural ground of this root, because it lends itself to measurement: claim frequency and severity, attack surface, shared dependencies, accumulation scenarios. It can be modeled, imperfectly, and reading the imperfection of the model before signing is precisely the underwriter's job.
Not the town, but the political community: what is decided in common, the State, the border, war, sanctions. It is the root of politics, and it is exactly the field of political risk: expropriation, political violence, currency inconvertibility, contract frustration by a State. This risk cannot be modeled the way cyber is, for want of usable frequency. It has to be judged, country by country and act by act, and the decision rests on reading power more than on the law of large numbers.
A name that merely placed two specialities side by side would be a coincidence. This one names the point where they meet, and that is the central argument of the house: the clauses that decide the largest cyber claims are not a matter of information technology. They are a matter of the State. Four of them are enough to show it.
A cyber policy excludes war, and the whole question is what a war is when not a single shot is fired. The exclusions inherited from the last century were written for armed conflict, and the litigation that followed NotPetya showed how poorly they held against a cyber attack attributed to a State. The London market answered by requiring, from 31 March 2023, a dedicated exclusion for state cyber operations in every standalone cyber policy written by its syndicates. Reading that clause means reading a definition of war.
The exclusion only bites if the attack is attributed to a State, and attribution is a political act before it is technical evidence. Market clauses defer first to the official attribution made by the government of the State where the affected computer system sits. Whether an insurance exclusion applies then depends on a diplomatic decision, taken on a timetable that is not the claim's, by an authority that is not a party to the contract.
The most recent clauses go further: they exclude the state operation that causes a major detrimental impact on the functioning of a State, its essential services, its security or its defense. The threshold of the exclusion is no longer the severity of the loss suffered by the insured, but the harm done to a sovereign. That is a political risk concept, written out in full in a cyber contract, and it is judged with the tools of political risk.
A ransomware attack is sometimes settled by a payment. If the recipient is on a sanctions list, the payment becomes unlawful, and the insurer that reimburses it is exposed in its own right: the US Treasury advisory of 21 September 2021 names cyber insurers expressly, under a strict liability regime. The decision to pay is therefore taken on a fact that nobody knows when the claim arrives: who the attacker really is, and which list a State has put them on.
In each of these four cases, the question that decides a cyber claim is put by a State: it fights, it accuses, it is struck, it forbids. A cyber underwriter who ignores political risk cannot read their own exclusions; a political risk underwriter who ignores cyber cannot see where state violence now travels. An underwriter who holds both sees what two specialist underwriters keep passing to each other.
Explaining a market and taking a decision in it are two different skills. An underwriter does not describe a risk: they say yes or no, at what price and on what terms, on incomplete information, knowing they will be wrong one time in five.
The name commits this house to practicing the second skill. It writes no risk and carries none: it publishes decision exercises that are dated, argued on the information available on the day they are settled, stated together with the signal that would prove them wrong, and later reread against what actually happened. The risks are composed from real market configurations, or are public and already past: never a third party's actual file.
