Cyber War-Exclusion Self-Test
The fastest-growing reason a cyber claim gets contested is a war / hostile-cyber-activity exclusion. Since 2023 the Lloyd’s Market Association model clauses (LMA5564–5567) exclude state-backed cyber operations to varying degrees. Walk your incident through the tests those clauses apply and see where it is likely to land. Highly simplified and hedged — wordings differ, attribution is hard, and this is not legal or insurance advice, not a coverage determination.
LMA5564 (broadest exclusion): Excludes loss from war and from state-backed cyber operations, with the least cover given back. Generally no carve-out for bystanding-cyber-asset or collateral losses.
Work through each test. Answer "Unsure" honestly — the attribution questions are genuinely hard and that uncertainty is itself the finding.
What this self-test does
- Since 2023 the Lloyd’s Market Association model cyber war / hostile-cyber-activity exclusions (LMA5564–5567) exclude state-backed cyber operations to varying degrees — the fastest-growing reason a cyber claim is contested.
- Walk your incident through the tests those clauses apply (war between states? state-backed? major detrimental impact? government attribution? bystander spill?) and see where it likely lands.
- Pick which of the four clause variants your policy uses and the result adjusts for the cover each gives back.
- Highly simplified and hedged — wordings differ, attribution is hard, application is fact-specific. Not legal or insurance advice.
Why this matters
As state and state-sponsored cyber activity has grown, insurers have moved to exclude it — and the war / hostile-cyber-activity exclusion is now the live frontier of cyber-claim disputes. The hard part is not the headline ("war is excluded") but the state-backed limb: the impact threshold and, above all, the attribution mechanics, which decide whether an ambiguous, geopolitically-tinged attack falls inside or outside cover.
This self-test helps you reason about your own exposure and, more importantly, prompts you to read your actual endorsement and negotiate the variant and give-backs before a loss. It is a simplified educational model, not legal or insurance advice; a real war-exclusion question belongs with coverage counsel.
Frequently asked questions
What is a cyber war exclusion (LMA5564)?
It is a policy endorsement that excludes losses arising from war and from state-backed cyber operations. In 2023 the Lloyd’s Market Association published a family of four model clauses — LMA5564, 5565, 5566 and 5567 — that Lloyd’s syndicates were required to attach (or an equivalent) to standalone cyber policies. All four exclude cyber operations occurring in the course of war between states; they differ mainly in how much cover they give back for state-backed operations outside declared war and for organisations that are unintended "bystanders" to a state operation. LMA5564 is the broadest exclusion; LMA5567 gives back the most cover.
Does the cyber war exclusion apply to ransomware?
Usually not, because most ransomware is run by financially-motivated criminal groups, not states — and the exclusion bites on operations carried out by or on behalf of a state. The hard cases are where a ransomware or wiper operation is attributed to a state or a state-sponsored group, or where it causes a major detrimental impact on a state’s functioning. Then the state-backed limb of the exclusion can be in play, and whether it applies turns on the clause’s attribution provision and impact threshold. If a criminal gang simply happens to be based in a particular country, that alone generally is not "state-backed".
How is attribution decided?
The clauses contain attribution provisions, and this is the most contested part. Typically the insurer may rely on a formal attribution by the government of the state in which the loss occurred (or another relevant government); some wordings allow the insurer to infer attribution from other objective evidence where no formal government statement exists. Because formal state attribution is often slow, political and incomplete, the inference provisions are where much of the dispute sits. If your risk includes geopolitically-motivated attackers, understanding your clause’s exact attribution mechanics is essential.
Is this tool a coverage determination?
No. It is a highly simplified, educational walk-through of the tests the LMA model clauses apply, to help you understand your exposure and ask better questions. Real endorsements vary (including non-LMA bespoke wordings), the thresholds and give-backs differ between the four variants, and any actual determination depends on the full facts and the precise wording. It is not legal or insurance advice — take a real war-exclusion question to coverage counsel and your broker.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.