Cyber Claims Triage Is Not Authority to Decide a War Exclusion

Our alert arrives with the confidence of a machine. A domain controller is unreachable. Backup jobs have failed. An endpoint tool has found a familiar strain of malware. An incident platform ranks the event, retrieves the affected assets, opens a case, and recommends a vendor before anybody finds the policy jacket. That is useful. It does not answer the first claims question.

The first cyber question is not whether the alert is technically credible. It is whether we hold enough evidence to exercise a contractual decision right.

An alert establishes that something is wrong. It cannot establish that our infrastructure exclusion applies. That a cyber operation was state-backed. That an attestation was inaccurate. Or that payment authority exists. Those are not adjacent flavours of technical classification. Separate decisions, different owners, different consequences. So the useful automation has a modest job. Capture first notice. Preserve the incident record. Verify a policy was in force on the reported date. Retrieve the endorsements that attach. Get the right people moving. The hard part is stopping where an evidence feed becomes an interpretation. That stopping point matters most when the incident feels urgent. Cyber response has real clocks. It also makes every clock look like permission.

The claim file opens before the model is confident

At first notice, intake captures date and place of loss, the reported event, affected parties, report numbers. On a cyber file it should also keep the policy version, retroactive date, retention, waiting period, endorsements, initial indicators of exfiltration, and every version of the technical finding that later changes. We verify standing and policy currency.

We are not adjusting the loss yet.

The fork comes next.

Facts sitting cleanly inside coverage enter ordinary indemnity handling. Facts touching an exclusion, a condition, late notice, uncertain insured status, or a state-backed attack need a coverage-in-question flag. Before any adjuster speaks as though coverage were settled. The non-waiver sequence exists because paying without it can later be argued as an election.

A confidence score does not repair that.

It hides the moment the problem started. Which is an excellent place for automation to be strict. It spots missing documents, assigns an adjuster, preserves the rule that raised the flag, and keeps settlement closed until it clears.

It should not infer the missing fact.

“The system was very sure this looked geopolitical” will not improve a coverage position letter. The hotline call does something different. It constitutes notice, and activates our panel.

A breach coach is assigned.

Counsel retains the digital forensics firm, so the investigation and report sit under solicitor-client privilege rather than becoming an ordinary business record. Most policies want prior consent before covered costs run.

An off-panel vendor can be approved.

It cannot be assumed.

A pre-existing IT supplier that spends four days on containment before the hotline call may have done necessary work and created a reimbursement dispute.

The response should move.

It should not answer the coverage question by accident.

One incident, several coverage clocks

Cyber claims turn difficult when we bill the incident once. It is several coverage components at different speeds. First-party response costs operate on discovery during the period, promptly reported. On a ransomware event that path covers forensics, negotiation, data restoration, extortion, extra expense, and business interruption.

Third-party liability is claims-made-and-reported.

A demand, a regulatory proceeding, or a lawsuit may not arrive until after the technical recovery looks finished. The legal claim has its own trigger and evidence.

The difference shows in the ransomware example.

A $5M primary tower. A $250,000 each-claim retention. A twelve-hour business-interruption waiting period.

The waiting period is a deductible in hours.

The period of restoration starts after it ends, and finishes when operations are or should have been restored.

Not when the last ticket closes.

Lost net profit and continuing expenses measure separately from extra expense.

Temporary manual processes, overtime, expedited freight.

None of that delays the response.

It names the bucket before spend consumes it. Extortion, contingent interruption, and bricking carry sublimits inside the tower. Data restoration pays to recreate data from other sources. It does not pay for data nobody can recreate. Defence costs erode the same $5M that funds the settlement. Call all of it “incident cost” and the file gets faster to misunderstand.

The extortion gate needs its own discipline.

Written consent comes before payment.

Counsel and the negotiators assess the threat actor.

The facilitator screens wallet and actor for sanctions.

Canada has no statutory prohibition on ransom payment.

But paying a listed entity engages the sanctions regime and the Criminal Code.

A sanctions hit ends the conversation.

The file becomes restore-from-backup.

Negotiation runs three to seven days.

It tests sample decryption, tests exfiltration claims, and buys restoration time. The insured funds through a facilitator and we reimburse.

We do not wire cryptocurrency.

Facts for a controlled file, not prompts for an autonomous path.

Notification is a response duty, not an admission of coverage

Encryption is not the decisive scoping question.

Exfiltration is.

Forensics hunts staging directories, bulk archives, outbound transfers before detonation. Encryption alone gives us restoration and interruption in weeks. Confirmed exfiltration adds notification and liability work for years.

That work carries Canadian duties.

PIPEDA requires reporting to the Privacy Commissioner and to affected individuals where a breach of safeguards creates a real risk of significant harm. It also wants records of all breaches for two years.

Alberta’s PIPA and Quebec’s Law 25 add their own, and Quebec wants an incident register.

Document review says whose information went, and what it was, before we can notify coherently.

The mistake is treating that duty as an admission of coverage.

We can sequence counsel, document review, notices, a call centre, and credit monitoring while investigating an attestation, a consent condition, or an exclusion.

Regulatory response and policy indemnity run in parallel.

They are not one approval.

A good record marks regulatory trigger, coverage trigger, and the authority behind each expense.

Which matters when the first report says “critical infrastructure.”

The phrase is a routing signal.

It is not a conclusion about an exclusion.

Essential services appear in state-backed clauses beside power, water, health, finance.

The wordings do not all do the same thing.

Some exclude only where the operation majorly damages a state’s functioning.

Some focus on essential services.

Some exclude all state-backed activity, impact or none.

The machine classifies the affected environment.

It can’t choose which clause the insured bought.

A war exclusion is an attribution process

Every cyber policy excludes war.

Cyber wordings are proprietary, and the definitions vary materially.

The modern clauses define an operation by or for a state, and supply an attribution mechanism.

They attach when the government where the affected systems sit attributes the operation.

If it hasn’t spoken, we may rely on other objectively reasonable evidence.

That fallback isn’t a technical detail.

Governments attribute slowly, incompletely, and politically.

The fallback lets us decide the fact that decides coverage.

A malware label, a vendor assessment, a cloud-region tag, a probability built from them: all relevant evidence.

None should become our final interpretation without accountable review.

Lloyd’s Bulletin Y5381 makes the history concrete.

Issued in 2022, it made standalone cyber policies at Lloyd’s exclude state-backed losses from March 2023.

The Market Association published a family of clauses with different carve-backs.

Lloyd’s capacity carries that requirement through reinsurance into placements we issued.

The operative question stays the wording, the mechanism, the carve-back.

I put the escalation boundary here.

Where the incident involves an alleged state actor, essential-service disruption, a potential major detrimental impact, or a clause relying on objectively reasonable attribution, the workflow opens a coverage-in-question file.

It assigns counsel or an accountable reviewer.

It preserves the evidence and the changing assessments.

And it stops the payment path reading confidence as an answer.

Nothing here votes against automation.

It asks automation to leave the evidence intact long enough for somebody to decide what it means.

Reserve before authority, position before settlement

Claims already has a useful order for this.

Within days of assignment we set a case reserve.

Estimated ultimate cost, indemnity split from allocated expense.

Breach counsel, forensic accountants, defence counsel, experts: all in that expense figure.

Not buried in the loss.

The reserve decides who may act.

Authority runs adjuster, team leader, claims manager, round-table, with thresholds for reserve changes and offers.

Crossing one triggers treaty reporting, large-loss reporting, or an event code tracking aggregate exposure.

A reserve isn’t an afterthought entered once the claim gets expensive.

It is a control on settlement authority.

The discipline is moving it when information arrives.

A forensic finding. A coverage opinion. A claimant demand. A new notification population. A defence assessment.

Stair-stepping a reserve as pressure builds isn’t prudence.

It makes a run of bad authority decisions look gradual.

Before anybody asks for authority, reserve and evaluation align.

The approver sees one estimate, not two competing numbers.

The same separation covers our letters.

A non-waiver agreement is bilateral, signed before we investigate.

A reservation of rights is unilateral, naming the defences we preserve.

A coverage opinion is privileged advice.

A coverage position or denial letter goes to the insured.

A denial states the facts, the wording, its application, next steps, and the complaint contact.

Calling every early letter a denial gives a routine step unnecessary drama.

Measure the decision, not only the clock

The board hears time to first contact, first payment, closure.

Real measures, all of them.

So are closure ratio, aged pending, diary compliance, reopen rate.

The last qualifies the rest.

A closure statistic without reopens can be manufactured.

They aren’t enough for a coverage-sensitive operation.

We also need denial rate by cause, closed-without-payment rate, overturn rate.

Denials reversed on review, on escalation, or after litigation, over denials issued.

Concentration in one cause code points at an interpretation problem.

Evenly spread reversals point at investigation.

A near-zero overturn rate may mean the reviewer reports to whoever denied.

Complaint outcomes belong on the same view.

Complaints per ten thousand claims. Escalation to the internal complaints officer. Escalation to an ombudservice. Upheld rate outside. Days to acknowledge, days to final position.

They say whether the process holds up after the incident room empties.

We report conduct data through the annual market-conduct statement.

Quebec wants a complaints register and prescribed timelines under the AMF regime.

The position worth defending is plain.

Use automation to keep facts, shorten assignment, make escalation visible.

Don’t ask it to turn a war exclusion into a score that becomes a coverage decision.

Fast evidence is an advantage.

Automatic interpretation is a different product.