Iran conflict exposes the hidden gaps in corporate insurance

Cyber exposure is, in Wilde’s assessment, "possibly the least understood risk on most corporate balance sheets." He is unambiguous: "Companies are significantly underestimating it." After the 2017 NotPetya attacks, Merck and other large corporations fought their insurers over whether Russian state-backed malware constituted an act of war. Lloyd’s of London subsequently issued market guidance requiring explicit exclusions for state-backed cyber activity; those exclusions have since migrated through the London market and into U.S. carrier forms.

Attribution compounds the problem. Determining whether an attack was state-sponsored can take months, giving carriers grounds to hold payment pending a determination. Yasir Andrabi, global head of Agentic AI Solutions at professional services firm Genpact, warns that state-affiliated cyber attacks may test conflict exclusion clauses in ways current policy language has not anticipated. The practical upshot, Wilde concludes, is that carriers are now "classifying an expanding range of events as acts of war" — a form of coverage tightening that never appears in a premium quote but becomes visible only when a claim is denied. "The biggest misconception," he says, "is that having insurance is the same as having protection."

What CFOs should check in their policies right now

The first step, according to Carlton Wilde of Bracewell, is to stop assuming that holding a policy equals holding protection. The provisions that determine whether a claim actually gets paid — war risk carve-outs, sanctions compliance clauses, physical damage requirements, and cyber attribution conditions — are buried in policy language that most finance teams have never stress-tested against a real conflict scenario.

On the marine and cargo side, companies should verify whether rerouting costs — extra freight, fuel, and delay expenses incurred by sailing around the Cape of Good Hope — are explicitly covered, since Wilde says they typically fall outside standard covered perils. For business interruption coverage, the key question is whether the policy requires direct physical damage to trigger a payout, because most geopolitical disruptions, including port closures and supplier shutdowns, will not meet that threshold.

For cyber coverage, the critical check is whether the policy contains an explicit exclusion for state-backed or state-affiliated attacks, following Lloyd’s of London’s post-NotPetya market guidance. Any company with suppliers, assets, or counterparties that could have a connection to a sanctioned jurisdiction should also review whether OFAC or EU sanctions clauses could block the transfer of claim proceeds even on an otherwise valid claim.

The immediate question for the insurance market is how carriers will update policy language as the conflict evolves — and whether the expanding definition of acts of war will be formalized in standard commercial forms or continue to surface only at claims time. For CFOs, the next stress test is practical: mapping existing policy terms against the specific exposures their companies carry in energy, freight, and cyber, before a claim makes the gaps impossible to ignore. Whether courts will ultimately side with policyholders or carriers on the new generation of hybrid-warfare exclusions remains an open legal question, with the first major test cases likely still months away.

See the rest on the next page ⬇⬇