Estimated reading time: 5 minutes
War used to have a front line. Armies crossed borders. Ships blockaded ports. Factories burned. The economic damage was visible, measurable, and contained by geography. That world is gone. Today, a state-sponsored attack can cross every border simultaneously, hit thousands of businesses at once, and leave no physical trace. Supply chains fracture. Payment systems fail. Operations halt. The damage is real, but the battlefield is invisible. Canopius Group has looked at that reality and done something few carriers have dared: it built a product to cover it. The London-based specialty (re)insurer has launched a dedicated cyber war insurance product, available now as an add-on to existing cyber policies where Canopius serves as the lead primary insurer.
“It reflects our commitment to staying ahead of emerging risks, however complex or unprecedented they may be,” said Camilla Walker, Head of Cyber and Technology UK at Canopius.
A New Category Of Risk
Cyber war has moved from theoretical to operational. State-aligned threat actors now target commercial enterprises far from any physical front line. Insurers have struggled to provide clear coverage for these attacks. The Canopius product aims to close that gap directly.
The new cover addresses two distinct scenarios. First, it covers state-sponsored attacks carried out as part of a declared physical conflict. Second, it covers state-sponsored attacks that significantly disrupt a country’s operations even without a formal declaration of war.
The War Exclusion Problem
War exclusions have been a flashpoint in cyber insurance for years. The Merck/NotPetya litigation exposed the ambiguity in standard policy language. Carriers and policyholders disagreed sharply on what “war” means in a digital context. Canopius is responding with a product that addresses that gap directly.
Walker framed the risk plainly: “Regional conflict can escalate into widespread cyber disruption, with state-aligned groups targeting commercial enterprises.”
How The Coverage Works
Canopius is offering the product on a limited basis. Buyers must hold a traditional cyber policy where Canopius serves as the lead primary insurer. The war coverage sits alongside that policy as an extension. Risk managers and brokers need to factor Canopius’s lead insurer role into placement decisions.
Why This Matters For Underwriters And Brokers
The cyber insurance market has long treated war and state-sponsored attacks as uninsurable. Standard policy language carved them out entirely. Canopius is now asserting that these risks are priceable and coverable. That is a significant market signal.
Get The Cyber Insurance News Upload Delivered
Subscribe to our newsletter!
Underwriters writing cyber war insurance must model accumulation risk carefully. A single state-sponsored campaign can hit thousands of businesses simultaneously. The correlation exposure is high. How Canopius prices and structures this product will be watched closely across the market.
Canopius’s Broader Cyber Strategy
This launch fits a clear pattern of deliberate cyber expansion at Canopius. The company has strengthened its cyber team with senior hires, including the appointment of Chris Getty. It has built out threat intelligence through a partnership with Group-IB. The carrier has expanded its US presence through a deal with Boost Insurance and made targeted moves into the APAC cyber market.
The Bottom Line
Cyber war insurance is no longer a hypothetical product category. Canopius has made it real. Senior executives and risk managers should evaluate whether their current cyber policies leave state-sponsored attack exposure uncovered. The gap is real. Now there is at least one carrier willing to price it.
FAQ Cyber War Insurance
Cyber war insurance covers business losses caused by state-sponsored cyberattacks. Standard cyber policies typically exclude these events through war exclusions. Dedicated cyber war coverage fills that gap.
The policy covers two scenarios: state-sponsored attacks carried out during a declared physical conflict, and state-sponsored attacks that significantly disrupt a country’s operations even without a formal war declaration.
Coverage is currently available on a limited basis. Buyers must hold a traditional cyber policy with Canopius as the lead primary insurer. The war product is purchased as an extension to that existing policy.
State-sponsored attacks create a high correlation risk. A single campaign can hit thousands of businesses at once. That accumulation exposure made the risk difficult to price. Most carriers responded by excluding it entirely rather than modeling it.
The Merck/NotPetya litigation brought war exclusions into sharp focus. Merck argued its insurer wrongly denied a claim for the 2017 NotPetya attack under a war exclusion. Courts largely sided with Merck. The case exposed deep ambiguity in how standard policy language applies to state-sponsored cyber events.
Review existing cyber policy language for war and state-sponsored attack exclusions. Identify whether your current coverage leaves a material gap. Engage your broker on whether dedicated cyber war coverage is available and appropriate for your risk profile.
Related Cyber Liability Insurance Posts
- Legal Industry Faces AI Boom and New Cybersecurity Challenges in 2025
- FAMOUS CHOLLIMA Unmasked: Insights from the 2025 CrowdStrike Report
- Executives Underestimate Cyberattack Costs, Willis Warns in 2025 Report
- Deepfake Defense: Reality Defender Launches Real Suite for Day-One Enterprise Protection
- Cyber Security Insurance For Small Business. What to Know.
