Skip to content
←Back to glossaryCyber

Hybrid warfare (gray-zone conflict)

Hostile operations kept below the threshold of open war, undeclared and hard to attribute, which is exactly what a classical war exclusion cannot read.

Definition

On December 25, 2024, the Estlink 2 power cable between Finland and Estonia was cut; Finnish authorities boarded the Eagle S, a Cook Islands-flagged tanker suspected of dragging its anchor along the seabed, and no state claimed anything. Hybrid warfare, or gray-zone conflict, covers operations that impose cost and uncertainty on an adversary while staying below the formal threshold of war. Cyberattacks, infrastructure sabotage, navigation-signal jamming, disinformation: they run through intermediaries that dilute responsibility, such as flag-of-convenience ships and criminal or diaspora groups. For insurance, it erases the four properties the classic war exclusion rested on: it is neither declared, nor attributable, nor bounded, nor kinetic. The founding question of any exclusion, does this loss arise from war, no longer has a certain answer. The market has tried to reframe it. Lloyd's Market Bulletin Y5381 of August 2022 requires syndicates to exclude state-backed cyberattacks from March 31, 2023, and the LMA 5564 to 5567 clauses hang that exclusion on attribution. Attribution is exactly what hybrid warfare makes hard to establish. Each loss then sits somewhere on a continuum between crime, espionage and war, rather than on one side or the other of a clean line.

Its 13 cross-references, woven across the glossary's 18 categories
Hybrid warfare (gray-zone conflict): Cyber glossary illustration, AlgoPolis
Example

In the Baltic Sea, undersea cables are sabotaged by ships dragging their anchors. On December 25, 2024, it was the Estlink 2 power cable that was cut, with no state claiming responsibility. It is a typical case of hybrid warfare, and one that defeats insurers' war exclusions.

Read next
CyberCyber operation (LMA cyber war definition)How the LMA cyber war clauses define a state cyber operation, the use of a computer system by or for a state, and why ordinary cybercrime falls outside it.Read the entry →CyberImpacted state (LMA cyber war exclusion)The LMA 5565 to 5567 threshold: a state-backed cyber operation with a major detrimental impact on a state's essential services, security or defense.Read the entry →CyberAttribution of a cyber operation to a stateWho decides that a cyber attack is state-backed, and how the attribution wording of the LMA cyber war clauses, A or B version, can decide the claim.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Sources
  • Finnish National Bureau of Investigation (KRP), investigation opened in December 2024 into the Eagle S and the Estlink 2 outage
Related terms
Related articles
#12Lloyd's Retreat from Hybrid War Risk
On the Wire, where this term came up
October 9, 2026300 Russia-linked cyber hits on UK firms: even if London attributed them, most would stay covered
Go further at the Academy
Course · RP-1What event occurred, and under which cover?
Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.