Act Of War Clause

What the clause does in cyber insurance

An act of war clause is not a technical cyber control, it is a coverage boundary. In practice, it attempts to separate ordinary cyber loss from loss the insurer views as war, hostility, or comparable state-directed activity, which makes the clause central when a cyber event may be tied to geopolitics or national security.

Because the wording can shift a claim from payable to excluded, the clause is often scrutinised only after an incident. That creates uncertainty for organisations that assume a cyber policy will respond automatically to a destructive event just because malware or remote intrusion is involved.

Why cyber attribution makes the clause difficult

Cyber events can be hard to attribute cleanly. Malware may be used by criminals, proxies, hacktivists, or state-linked actors, and the same operational pattern can be interpreted very differently depending on context, evidence, and the policy language. This is why act of war wording becomes contentious in cross-border incidents and other politically charged cases.

The issue is not simply whether an attack was large or disruptive. The harder question is whether the event fits the insurer’s and the insured’s understanding of war-like conduct, or whether it remains an excluded cyber criminal act. That distinction can materially change coverage outcomes even when the technical damage looks similar.

Why wording and attribution standards matter

Policy language is doing most of the work here. Terms such as “war,” “warlike activity,” “hostile acts,” and “state-backed” can be read narrowly or broadly, and the final coverage position may depend on how the contract allocates attribution risk between insurer and insured.

Because attribution evidence is often incomplete, organisations should treat the clause as a legal and operational uncertainty, not a theoretical footnote. The most useful review point is whether the policy clearly defines who decides attribution, what evidence is required, and whether cyber operations are treated differently from kinetic conflict.

For the security and investigation side of that uncertainty, practitioners often pair policy review with broader control and detection references such as NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5 Security and Privacy Controls, and MITRE ATT&CK Enterprise Matrix when they need to interpret an incident chain, preserve evidence, and document likely techniques.

What organisations should do before a dispute arises

Act of war clauses are easiest to manage before an incident, when legal, risk, and security teams can read the policy together rather than under time pressure. The practical task is to understand where the coverage boundary sits, what evidence would be needed to support or contest an exclusion, and whether the organisation’s cyber insurance strategy aligns with its threat profile.

That review should be especially careful for environments exposed to critical infrastructure risk, geopolitical targeting, or operations that could be misread as state-directed. In those settings, the clause is not just a legal formality, it is part of the organisation’s financial resilience planning.

When cyber operations and state-linked behavior are part of the threat model, broader references such as NIST Cybersecurity Framework 2.0 and NIST AI Risk Management Framework can help teams document risk ownership and incident handling expectations, while EU NIS2 Directive is relevant where incident response, supply-chain security, and management accountability shape the organisation’s resilience posture.

Risk and Threat Considerations

Act of war clauses create a coverage risk when the incident narrative is ambiguous and the insurer can plausibly argue that the event was war-like, state-linked, or outside ordinary cyber loss. In cyber insurance, that ambiguity matters because the same destructive outcome can be characterised as either insurable criminal activity or an excluded geopolitical act.

Failure mechanism: The loss is disputed at the attribution layer, where incomplete intelligence, conflicting expert views, or broad policy wording can push the claim into an exclusion even when the organisation suffered a real operational loss.

Impact: The insured may face unreimbursed recovery costs, delayed restoration funding, and legal dispute over coverage at the exact point when incident response is already expensive and time-sensitive.

Practitioner Guidance

Why practitioners should care: Insurance teams, security leaders, and legal counsel should read the clause together because coverage can turn on incident facts that emerge from forensic work, not just from the policy schedule. The practical objective is to understand how attribution, evidence, and war-like language interact before a claim is tested.

Common misunderstanding: Many organisations assume that “cyberattack” automatically means “covered cyber loss.” That assumption is too broad when the policy contains an act of war exclusion, especially if the event may be linked to state actors or broader conflict conditions.

Practitioner takeaway: Treat the clause as a pre-incident legal and resilience issue, not just a claims issue after the fact.

Related resources from NHI Mgmt Group

• Why do broad act of war exclusions create risk for companies seeking cyber insurance after a cross border attack?
• How should security teams prove DORA compliance for AI agents that act autonomously?
• How should organisations prove EU AI Act compliance across the AI lifecycle?
• How should security teams govern AI assistants that can act inside IAM systems?