When insuring war becomes impossible

Insurance has always refused to cover war, and that is exactly why the subject seems closed. Policies have always excluded acts of war, so the matter looks settled. It is not, and for a reason that has nothing to do with the old one. What has changed is not that war has grown more destructive, it is that we no longer know where it begins. Classic war was visible, attributable, declared, tanks, borders, flags. Today's war is a denied cyberattack, a sabotage without a signature, a proxy actor, a hybrid maneuver wearing civilian clothes. It was designed, deliberately, to remain unclassifiable. And a thing that cannot be classified can no longer be cleanly excluded.

Here is the thesis. Insurance's problem is no longer that war is uninsurable, that we have known for centuries. The problem is that the boundary of war, the oldest and clearest line in the whole edifice of insurance, has been rubbed out by a form of conflict built to blur categories. The war exclusion assumed a recognizable war. Modern war has learned to hide inside the very categories that served to keep it out. War has become uninsurable not because it is too large, but because it has become too ambiguous to locate.

The border checkpoint and the infiltrator

One must first understand why the war exclusion exists. War violates everything that makes a risk insurable. It is correlated, it strikes thousands of insureds at the same instant, it is catastrophic in scale, and it is deliberate, shaped by a human will seeking maximum harm. No private capital can carry it, so the insurer places it outside the contract, as it places outside anything that would destroy mutuality. So far, nothing but the very old, and the very sound.

But this exclusion rests on a precise mechanism, attribution. To exclude an act of war, one must be able to assert that a state committed it, deliberately, as an act of conflict. Classic war made that assertion easy, one saw the army cross the border, one heard the declaration. The old war exclusion was a border checkpoint, one watched the troops pass, one could name the enemy. Hybrid war is an infiltration in plain clothes, no uniform, no flag, no declaration, and it renders the checkpoint useless. The mechanism insurance relies on to keep war out, attribution, is precisely the one the modern attacker has made it their mission to defeat.

This is not speculation, the courts have already lived through it. When a global cyberattack struck large companies in the late 2010s, some insurers refused to pay by invoking the war exclusion, several states having attributed the attack to a state actor. It took years of litigation to settle the meaning of a single word, war, in a contract written for a world where war could be seen. Schooled by these battles, the London market eventually imposed in cyber policies more explicit exclusion clauses, making the refusal of coverage conditional on state attribution. But drafting the clause does not resolve the substance, it merely transfers the difficulty to whoever must, one day, assert or deny that a state stood behind the screen.

The inversion that guards against the amateur and abandons you to the professional

From this dependence on attribution comes a perverse inversion, and it is the heart of the argument. The more sophisticated, state-grade and dangerous an attack, the more it is built to be deniable, so the harder it is to attribute, so the harder it is to exclude. It follows that the worst risks, the state-level attacks, are precisely the ones most likely to fall, in the ambiguity, inside the coverage. The war exclusion thus defends the insurer against amateur conflict, the kind one can name, and abandons it before professional conflict, the kind that knows how to make itself unnameable. Insurance's defense against catastrophic risk fails exactly where the risk is most catastrophic, because that is where it is best concealed. The intuition is reversed, it is not the small attack that slips through the gap, it is the largest.

This ambiguity then forces a choice that is no longer actuarial but political. Someone must decide where war begins, and that someone becomes a state, through its attribution statements, or a judge, through the lawsuits that open over the meaning of exclusions. Insurance, faced with the dissolved boundary, finds itself outsourcing the definition of war to governments and courts. The London market did try to redraw the line, imposing in cyber policies more explicit war exclusions anchored to attribution by a state. But this attempt does not remove the ambiguity, it relocates it to another question, who holds the pen of attribution. Deciding that a state stood behind the attack becomes the act that decides who pays, and that act no longer belongs to the insurer.

To this is added a difficulty reinsurance dreads above all, invisible accumulation. A single piece of software, a single flaw, a single compromised provider can link thousands of policies that nothing seemed to gather, so that one event runs through an entire book as a fire leaps from roof to roof. Hybrid war sharpens this peril, because it targets precisely the shared infrastructure whole sectors depend on. The insurer therefore dreads not only being unable to label the attack, it dreads that the attack strikes it everywhere at once, turning an isolated loss into a correlated blast that neither its balance sheet nor its reinsurer's was calibrated to absorb.

The gap only the state can fill

There remains the debate all this opens, and it is grave. Should insurers cover state-grade cyber, systemic, correlated, potentially ruinous for a whole book at a single stroke. If they cover it, they lodge in their balance sheets a bomb no capital can absorb should it truly detonate. If they exclude it, they leave a gaping hole of protection, at the very moment societies depend most on their digital infrastructure. That hole can only be filled by public power, by a state backstop of last resort, exactly as for the most extreme climate catastrophes. The boundary of war thus rejoins the question, met elsewhere, of what the market cannot carry alone and only the state can guarantee.

This logic is not new, reinsurance already knows the model. For terrorism, after attacks that threatened to drain the market, several countries created pools backed by the guarantee of the state, where insurers mutualize the risk and public power steps in beyond a certain threshold. The same pattern is taking shape for state-grade cyber, a risk too correlated for a private balance sheet, because a single well-built attack can strike thousands of insureds at the same instant, exactly the concentration reinsurance usually seeks to flee. The dissolved boundary of war therefore pushes toward a three-story architecture, the insurer for the ordinary, the reinsurer for the exceptional, and the state for the uninsurable, each taking over only where the previous one can no longer carry. What plays out behind the definition of war is also a silent redistribution of risk between the private and the public.

In the meantime, it is a concrete victim who stays stranded midstream. The paralyzed hospital, the halted energy distributor, the blocked factory discover that they might well be paid by no one, the cyber insurer raising the war exclusion, and no other mechanism taking over as long as the labeling stays pending. The protection gap is not a lawyer's abstraction, it has an address, it falls on a specific organization, on a specific day, at the moment it most needs help. And that organization has committed no fault, its only wrong was to be struck by an attack too well denied to fit into a box. The dissolved boundary of war is paid, at the end of the chain, in care not given and machines at a standstill.

And behind this debate hides another, more troubling still. Whoever controls the meaning of the word war controls who pays. If a government labels a cyberattack an act of war, it triggers the exclusions and relieves the insurers, letting the cost fall on the victims or the taxpayer. If it abstains, it keeps the coverage in force and lays the weight on the market. The labeling, a seemingly descriptive act, is in reality a decision of allocation, it names the payer. The definition of war has become a financial stake as much as a strategic one, and that is a novelty which insurance, the discipline of clean boundaries, takes full in the face.

The wars we no longer declare

The dissolving boundary is not only an insurance problem, it is the mirror of a world where the line between war and peace has itself been deliberately blurred. Contemporary conflicts are waged without declaration, in a permanent gray zone where one can strike without ever admitting to being a belligerent. Insurance, which lives by drawing clear lines around risk, is among the first institutions to feel the ground move, because its oldest exclusion no longer knows where to fall.

This ambiguity is not an accident, it is a strategic choice. A state that strikes without declaring itself obtains part of the effects of war without paying its price, neither open retaliation, nor international condemnation, nor the mobilization of the adversary. The blur has become a weapon, precisely because it paralyzes the response, one knows neither whom to accuse nor how to label the aggression. Insurance is only collateral damage of this strategy, caught in an ambiguity that others cultivate for entirely different reasons. But this collateral damage is revealing, because it shows that a world which deliberately blurs the boundary of war renders inoperative, at the same stroke, all the mechanisms, legal, financial, insurance-based, that rested on the clarity of that boundary.

The question is therefore no longer whether war is insurable, it never was. It is who will decide, in a world of denied conflict, where war begins, because that decision now determines who bears the cost of the new wars, the ones waged without ever being declared. As long as that question stays open, every major cyberattack will reopen the same trial, the trial of the meaning of a word, and we will discover that insurance, in excluding war, had leaned on one certainty, being able to recognize it, that the adversary has precisely taken away. War has become neither more insurable nor less, it has become invisible, and one does not exclude what one does not see coming.

Someone, one day, will have to decide, not case by case in a courtroom years after the fact, but upstream, through a clear convention on what counts as war in the digital age. As long as that convention is missing, every major attack will be at once a loss and a lawsuit, and uncertainty itself will become a cost, the cost of not knowing, when taking out coverage, what one has really bought. Insurance needs clean boundaries to function, and modern war works to erase them, so that the question of the insurability of war has become, without our quite noticing, a question about our collective ability to name what we are living through.