Unpatched vulnerability exclusion
A clause that reduces or removes cover when the loss exploits a known vulnerability whose patch had been available for a set period, often with coinsurance that grows over time.
The unpatched vulnerability exclusion targets losses caused by exploitation of a publicly known flaw for which the vendor had published a patch that the insured did not apply within a given time. It responds to a statistical reality: a large share of intrusions exploit old vulnerabilities, sometimes years old, rather than unknown flaws. Wordings have moved toward a graduated rather than binary form. During a grace period after the patch is published, cover is full; beyond it, the insured bears a growing share of the loss through coinsurance, up to full exclusion after several months. The gradation reflects a compromise: it recognizes that deploying a patch takes time in a complex system, while refusing to insure negligence indefinitely. It nonetheless raises practical difficulties. One must establish which vulnerability was exploited, which only forensic investigation can do, and the date on which the patch was actually applicable. For the underwriter, the clause shifts part of the patch management risk onto the insured, but makes the outcome of the claim depend on expert findings.
A typical wording provides full cover for 45 days after a patch is published, then 5 percent coinsurance up to day 90, 25 percent up to day 180, and exclusion beyond. The 2017 Equifax breach is the illustration usually cited: it exploited an Apache Struts flaw that had been patched two months earlier.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.