Silent cyber (non-affirmative cyber)

In June 2017, NotPetya cost Merck about $1.4 billion, and Merck turned to its all-risk property insurers: policies written for fire and machinery breakdown, silent on cyber. A New Jersey court held that the war exclusion the insurers relied on did not apply, a ruling upheld on appeal in May 2023, before a settlement in January 2024. Silent cyber is that exposure: cyber risk sitting implicitly in traditional policies (property, general liability, business interruption) that neither include nor exclude it. They were drafted before cyber was treated as a separate peril. The policy then pays a loss nobody priced. The insurer loses twice: an unmeasured and therefore unreserved exposure, and accumulation, since one event can hit several lines at once. The PRA flagged it as early as July 2017 (SS4/17). Lloyd's ruled on it with Market Bulletin Y5258 of July 2019: every policy has to state its position, starting January 1, 2020 for the first property lines. Either it covers cyber and prices it, known as affirmative cyber, or it excludes cyber unambiguously. The term therefore names a drafting gap, one that regulators and underwriting guidelines are working to close. The boundary is still fought over in litigation, because calling a loss cyber usually means establishing the primary technical cause of the damage, which is rarely simple. Not to be confused with affirmative cyber: silent cyber is the state of a policy that says nothing; affirmation makes it speak, by covering or excluding. The word appears nowhere in the policy, by definition; you see its removal in a cyber attack exclusion such as CL380 of 2003, or in a named and priced cyber extension.