Exclusion clause
A contractual provision that removes certain risks, events or circumstances from the scope of cover.
An exclusion clause expressly removes from the scope of cover certain risks, events or circumstances that the general conditions would otherwise cover. It is how the insurer draws the boundary of the cover: it sets aside risks that are uninsurable, too volatile, already covered elsewhere or contrary to public policy, such as the insured's willful misconduct. In law, exclusions are construed strictly. They must be formal and limited, meaning drafted unambiguously and without hollowing out the cover, failing which a court may set them aside. This requirement of clarity feeds the most frequent disputes, and a poorly drafted or overly broad exclusion is regularly invalidated. In cyber, exclusions shape much of the cover: acts of war, infrastructure failures, bodily injury and property damage that fall under other lines. They determine, as much as the insuring clauses do, what will remain at the insured's own expense in the event of a loss.
Textbook case: a cyber insurer includes an exclusion for a known vulnerability left unpatched for more than forty-five days. When a loss is caused by exploitation of Log4Shell, the claims handler establishes that the insured had received the ANSSI alert two months before the attack without applying the patch: the exclusion applies and the 800,000-euro loss remains with the company, effectively transferring the patching incentive from insurer to insured.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.