New Cybersecurity Insurance Exclusions Avoid Payouts from Nation State Hacks

The recent announcement by the insurance giant Lloyd's of London may be the biggest cybersecurity news of the year, and it might not seem all that relevant, but strategically this will likely shift the entire industry and politics of cybersecurity. Lloyd's has defined mandatory exclusions on cybersecurity insurance which will broadly exclude hacking that could be attributed to hostile nation-state activities. That could exclude insurance carriers from paying a large percentage of all catastrophic cyberattacks that we currently see in the industry. Ransomware, economic espionage, attacks against government services and national critical infrastructure sectors would be excluded from insurance coverage. The fallout may upend entire cyber insurance industry. What Lloyd's is trying to do is to protect itself against situations that are driven by one nation attacking one or many others. And this does make sense, and we do see a precedent in other insurance clauses and exclusions. Typically, if a wartime activity burns your house down, it's probably not going to be covered. Things of that sort. So it does make sense. However, cyber is a lot different than the normal areas of insurance. So it doesn't make sense in all cases. Well, at the very least, it's very, very confusing. Now, trying to do this makes a, a lot of sense for the insurance carriers, right? They need to protect their investment. They need to still be in business. They can't be paying out if something catastrophic happens. Happens at the hands of another nation. But again, this is a step forward to make that happen, but it may not be the end state because it is really not that easy to do. And unfortunately, it can be manipulated by several different parties. The insurance industry is trying to enforce that precedent, which tends to be a common theme in most other large business class insurance policies. With cybersecurity, there is a tremendous amount of unpredictability and danger to those who are buying insurance, which is why they're buying insurance. But a lot of it is really unknown. We don't know all of the attackers out there or their capability, and they could attack on a whim and target either very narrowly or any business within a country or within a collection of countries. The challenge there is much different than what insurers are used to. In fact, insurance in general, their traditional methods of determining what should the premiums be and how much should they charge for how much is going to be insured, all of those normal processes that they use, that they've used for, you know, hundreds and hundreds of years. They don't work with cyber. The normal attribution tables, so for example, you know, earthquakes or fires, insurance maintain a vast database of occurrences which give them over a large, large period of time these actuary tables to say what is the likelihood based on where you're at, what kind of controls, things of that sort. In the normal method for insurance companies to look at the rate of occurrence of something that happens, as well as what is the average impact, that gives them a very good understanding on what it's going to cost over time, given a certain pool of customers. And it's fairly accurate. It's accurate enough that they have created a huge global business helping companies stay insured for those unusual and unfortunate major events. But again, it doesn't work that way in cybersecurity. The rate of occurrence is not easily predictable, and it can change by orders of magnitude, as well as the average impact. So trying to run these numbers, it just doesn't work. All the normal tools that insurance hold close and embrace for comfort fail. Now, that hasn't stopped the insurance industry. In fact, for many years, they've gone forward looking at the business opportunity and put together insurance packages. The industry's embraced it. They really want and need these types of insurance packages. But there's been a problem. Some years for some companies, they estimated fairly well, and other years for those same companies or, or others, they vastly underestimated. So there just isn't consistency. And when you lack consistency, you lack the ability to predict and, and make sure that you're in the green, that you're profitable. The insurance industry has a problem here and they realize it. In fact, you know, just recently they've been in their period of readjustment trying to figure out how to better estimate this. And in fact, taking, even forward steps in requiring the insured to meet a certain standard, uh, controls for cybersecurity to help mitigate some of those risks. And what that does is it makes it more predictable. Well, at least a little bit, and that's good, but nowhere near where they need. In fact, if you were to go out to a major insurer today, a large company, and say, I need insurance, there would probably be several hundred questions. In fact, they may even send out a team to do an assessment, and then they would come back with a whole set of requirements of controls and oversight and auditing that would need to be done just as a baseline to even get a quote. Okay, that sounds reasonable. It helps raise all boats and make sure we've got some cybersecurity, but there are problems even with that because the variance is still so great And unfortunately, sometimes businesses aren't completely forthright in answering those questions, or the questions are vague enough that you can kind of beat around the bush. You can kind of vaguely answer it, uh, in a positive way. Insurance companies have now had to come out and challenged paying customers during incidents if they find that the company actually didn't adhere to what they stated, the controls that they stated. So again, there's challenges there, and we've seen big court cases. Uh, Merck and Company, actually, when they got hit by, um, you know, a major cyber attack, the insurance company refused to pay it because they felt that it was a nation-state, nation-sponsored type of an attack. Therefore, that fell into the generic clause of wartime activities and they didn't wanna pay. Well, they were sued by their client and the judge found that yes, they actually were culpable for paying out coverage on the $1.4 billion recovery costs suffered by their client. So there's litigation that goes on here. And so this whole period of readjustment is trying to figure out how do we estimate, you know, better, you know, within a decent margin, what the occurrence and cost are going to be. Can we put in some minimum controls to help rationalize and keep those numbers sane and hold people and organizations accountable if they don't do that? But still, it is a problem. So the result here is Lloyd's is putting in exclusions that are very specific in regards to what will and will not be covered. However, the definitions of those specifications are really kind of up for grabs, and they, they, they try, they do a good job in at least setting down some baseline expectations and start to define some of those terms, but as you're going to see, there are some problems. Is this bad for the insured? Well, yes and no. No, if the insurers can actually get to a point where they're confident and they can put forth a good estimate that is competitive, that is realistic and affordable by the, by those that are seeking insurance. It's good. It's good for everybody. It's good for the insurance industry and their business. And it's good for those who are seeking coverage on those black swan events, those very unusual catastrophic cybersecurity attacks., that could crater their company. But given the ambiguity of all of this, there becomes a certain amount of— well, let's just say a lack of confidence in the coverage. If you buy coverage for ransomware, does that mean you're going to be covered in most cases? But if it's somehow, you know, sponsored by a nation-state or an actual nation-state attacking What are the chances your insurer is going to say, no, we absolve ourself of this? This is part of the exclusion. You're on your own. Well, that kind of undermines the entire purpose of getting that ransomware type of insurance. So there is a lot of challenges here for the insured, and a lot of it comes down to the attribution, because the heart of these exclusions is saying that a foreign country, as part of some effort, war-type effort, is attacking companies or governments of another nation. And in that case, we aren't going to cover that. Things get gray. In a traditional world, in a shooting war, you, you kind of see the troops and the guns in the fire, and you, you understand If a building is hit by rockets, okay, that's part of the war. But what if it's another country that is financially supporting something that a nation doesn't like and they intentionally go after them? That government's cyber force specifically goes after that company in another nation. Yeah, that would probably also fit into this category, probably. Okay, let's, let's get a little more unclear. What if it isn't the actual nation's, uh, agents and government workers that are doing this, their offensive cybersecurity team or military? What if it's a third party that the government funds? Pays or maybe just shields from prosecution a nation-state cyber criminal type of organization that has decided, I don't like companies in Country X because of their political stance against my country or my benefactor, therefore I'm going to go attack them. I'm going to go infect them with ransomware. I'm going to go demand millions. Maybe some of those millions end up in the coffers of governments like North Korea. Possible, right? North Korea is sanctioned. They are hungry for hard currency. They have, um, not only their own internal teams, they offshore, right? They bring in cyber warriors, right? Organized criminals to go steal money to populate their national coffers of hard currency. That fit in? Maybe, maybe not. What if there's no declared war? What if it's just tensions and how would you know? So if it comes down to attribution, that's where all of this becomes a problem because in cyber, it's really easy to masquerade as somebody else. I can make myself look like any other country. I can make myself look like a nation-state attacker. And if I'm a nation-state attacker, I may be able to make myself look like just a regular petty criminal or an opportunist or a data miner. It's really, really difficult to tell one packet from another in cybersecurity. Now, that doesn't mean people don't rush to conclusions. In fact, we see this all the time. We see a new attack get announced and there is a plethora of people that are willing to jump on the news to get some type of, you know, sensational headline or build their credibility or get a little bit of fame and automatically point the fingers at some nation or some, you know, shadow government or something. And yet they don't have the facts. Nobody— it takes a long, long time to do forensics investigations. And even when you do do that, it is near impossible to actually show attribution. Unless you have a living, breathing person you're able to capture and they say, yes, I did it for this government. You just don't know. And in some cases, people are standing up that had nothing to do with the attack and are saying, oh yes, it was from us. It was from our government. Even though it really wasn't them. The governments are being opportunistic for political maneuvering purposes. So it is a confused, shadowy mess. This is attribution today. When it comes to cyber insurance now, this is what it's gonna depend on. So that's where the challenge lies. Okay, so let's talk about some of the attacks that, that may get impacted here. Ransomware, absolutely. In fact, there was a recent report that showed last year, 70% of all ransomware were tied to foreign nations doing shadowy activities, and the money was somehow tied to those governments. Governments like North Korea, governments like Russia, right? These types of governments, governments like Iran, these types of governments who in many cases are sanctioned, are, you know, are seeking hard currency of the West to be able to purchase weapons and things to keep their government afloat, uh, or military running. So is a ransomware attack now— is that not going to be covered? Critical infrastructure, right? We all use electricity and we need food and, and things of that sort. What happens if there's critical infrastructure attacks against the financial sector, health sector, power, gas, potable water, all those kinds of things, and that causes business impacts. Does that get covered by this? Possibly. It may be an exclusion. And then we've got the differences between nation-state attackers, and these are the, the people that work for a nation. They are the offensive, sometimes in the military, sometimes in the intelligence group, whatever, but they get a paycheck from the government., and what they do is they hack, right, for political purposes, for whatever. Do— does anything that they do fall into this? Possibly. And given that many of the reasons behind that is for political purposes, it could be lots of different targets, especially critical infrastructure. And on the other side, what about those cyber criminals? That may be either full-time, part-time, on-demand, occasionally work for a nation's government doing cyber attacks. If an attack gets attributed back to that cyber— organized cyber criminal, you know, organization, does that mean that attack automatically gets lumped in? It's very, very fuzzy here because some of the attacks might be, others might not be. Cybercriminals are pretty opportunistic, right? They will go after things, uh, they'll go after the easy targets. And the last one here is around economic espionage. And this is when a nation purposely goes out and harvests intellectual properties from companies in other countries. Why? To steal it so that they can give it to their own nationally owned or controlled companies so that they have a business advantage. And we've seen this all over. We've seen it in defense industries. We've seen it in telecommunications. We've seen it in semiconductors. We've seen it all over the place. And this is very, very common for countries like China. They don't have the innovation engine for developing their own new things. They go off and they basically copy and recreate in their own country for the benefit of their own industry, economy, and people, things that other countries may have patents for or, you know, have a leadership role in, and they just steal it as part of economic espionage. It's huge. It's huge in the trillions of dollars over the past several decades, especially in tech. Is that now going to be considered a war-type act if the policies between those two countries at any given time. There's harsh words, there's dirty looks. The way this is all written is not about it. There has to be a formal declaration of war. Would you look at the current activities between Russia and Ukraine? Russia invaded Ukraine, tanks, guns, shelling, destroying buildings, killing people. And yet Russia says it's not a war, but I think everybody else would say, yeah, that's a war. Very clearly, that's a war. What's the perceptions? How is this going to be argued and litigated? That we don't know. So exclusions, and this is really where the rubber meets the road. This is what Lloyd's has articulated as the exclusions they want written in these contracts. When it comes to attribution, they are very clear on an unclear subject. That can be interpreted many ways. Basically, for attribution— again, the toughest thing we're doing here is, is that attribution. They're saying that wherever the asset is, that local government, they really make the determination. So if the local government, whether it's their military intelligence, cyber team, president, premier, whatever, comes out and says this was a foreign attack, a foreign government attacked here, then that's what it is. If they don't say it or they take too long to say it, well, then it's up to the insurer. The insurer maintains the burden of proof. They have to prove that it fits in the exclusion, that it was a nation-state attack. And I like that. But again, what if they delay? What if they're thinking about it, you know? And this poor company may have been brutalized, needs money to recover, that may be withheld. Nobody wants to go into litigation against a major insurance company. Nobody, right? Even the big companies out there would rather not do that. So there's probably going to be a lot of settling and negotiation and delays. That's a problem. Let's talk about the attacks themselves. Lloyd's actually identified several different scenarios that built upon each other, and any of these inclusion or exclusions may be included in the contracts. So it may be broad, it may be more narrow. And the first one was if a nation attacks another government services. Okay, that kind of makes sense. So if you attack somebody's intelligence community, Defense Department, uh, government payroll, things of that sort, it may fall into this exclusion policy. All right, the next layer down is quite a bit broader. It talks no, not only about if government itself is attacked by another government, but the critical infrastructure, the national critical infrastructure, which like in the United States is mostly privatized. If impacts are due to critical infrastructure, you have a business and you're, you either are critical infrastructure or you rely on critical infrastructure, little things like, oh, electricity, So if another nation attacks your electrical grid and your business goes down for 2 weeks, chances are this is— that would fit the exclusion. You wouldn't be covered. So the third area is the first 2 combined, right? An attack against the government services, attack against national critical infrastructure. But the third adds an even broader component. It is the supply chain. So if your supply chain, if you have a certain vendor out there that you totally rely on, let's say a cloud vendor, and a nation-state attacks a critical infrastructure and that cloud vendor, that data center goes down, leaving you out in the cold, you're fine, you still have electricity, but your critical infrastructure, your supplier is out, which means you're out. That also could fall under this exclusion if that attack was originated from a nation-state or determined to be originated from a nation-state. Again, this gets very vague because we have to worry about all these complexities. And so my conclusion here is we know cybersecurity is really, really difficult. We live every single day with a tremendous amount of ambiguity ambiguity and chaos and unpredictability. That also applies to cyber insurance. They're suffering as well, and we do need to kind of come together and figure out what's rational. I'm not sure in this first instantiation of these kinds of exclusions if that's where we need to be. In fact, I'm sure it isn't, but reasonable exclusions are needed. So is the ability to do better in gauging how much loss, how often attacks are gonna happen, that the economics of insurance can work. Because without that, they don't know whether to say, yes, I'll insure you, or no. And if they say yes, they don't know how much of a premium to charge you. And if they get it wrong, they could go out of business. Which doesn't help the insured either. So we do need those reasonable exclusions, and we have to come overcome all the normal problems in cyber. And what it's going to come down to is that attribution. And this is where a lot of games can be played, especially politics. If governments around the world know that this is a problem, that there is an impact in regards to if they say, oh, it was this other country, they know that their countries may not get the insurance payments that they need. Whereas if they do say it, right, you may destroy your insurance companies. But again, if those insurance companies are in a different country, maybe that's okay. Maybe from a political sense, you want to point the finger at a country, maybe not even the right country, but point the finger at some country and say they were the ones that are still attacking us for whatever reason. And it may not be true. So there's some gamemanship that's involved here. And the reality is, even to determine that can take not hours or days or even weeks, it can take months sometimes years and sometimes never to truly understand what the attribution is, who really attacked and why. And in that delay, there may not be payments. There may not be any relief for the victims of these attacks. That in of itself can destroy companies, industries, economies. It comes down to attribution. Attribution has to be better. It has to be more accurate. It has to be faster. And we have to trust it. But there probably is not gonna be a whole lot of trust around attribution, which means we're gonna have a lot more litigation. So we're gonna see it in courts. And it's gonna be painful. And I expect that these revisions will evolve over time, get more refined over time, be tempered by the courts. And that's a good thing, but it will be a painful transition. And I think the insured have to think about this before they sign these contracts, and they need to have possibly a Plan B. I would strongly urge people to, to work with their lawyers to make sure that they're negotiating these contracts with absolute clarity and realize that some of the tax, in fact probably the biggest attacks that they may suffer, may be part of this exclusion and they won't get a dime. That's food for thought because the insured, guaranteed some of them are going to be left holding the bag. They're going to hold the burden. Now that's not out of malice by the insurers. They're trying to keep afloat and take advantage of this business and provide a service. But because of all this chaos and turbulence and unpredictability, this is where we are. It's not where we're going to stay, but this is the challenge now that we have. Lloyd's has taken that step forward and there will be cascading set of actions and changes and litigation and pushback and customer distrust. All these things until we get to a point that we all feel confident in the value proposition of what cyber insurance will provide victims. Thanks for listening. If you're interested in more things like this, please join, subscribe to Cybersecurity Insights on the YouTube channel. I'll put the link in the description there. And if you have any questions or comments or thoughts, please, I read all of them. I try and answer them all. Please give me your thoughts.