The murky waters of cyber warfare and insurance coverage

Issue 3 2022 Security Services & Risk Management

South Africa has seen a dramatic rise in cyberattacks and successful breaches during the past two years, as well as an accompanying surge in ransom demands.

In the most recent high-profile attack, credit reporting agency TransUnion South Africa revealed that at least three million South Africans have been impacted by a data hack, after the agency was compromised by hacker group N4aughtysecTU.

The proliferation of these types of attacks demonstrate how vulnerable organisations can be to cyberattacks and are forcing organisations to increasingly rely on their cyber insurance policies. At the same time, many insurers are looking to remain viable amid a changing cyber insurance landscape to try to manage their own exposure.

Ryan van de Coolwijk, product head at iTOO’s Cyber Insurance division, says that as cyber insurers are trying to manage their coverage of these incidents, companies must revisit their cyber insurance policies and rethink how they respond to incidents.

Unique cover

In South Africa, state-owned Sasria is the only non-life insurer that provides special risk cover to government entities as well as to all individuals and businesses that own assets in South Africa, as well as government entities. This is unique cover against risks such as civil commotion, public disorder, strikes, riots and terrorism.

However, says Van De Coolwijk, Sasria’s cover only extends to physical incidents of unrest, riots and terrorism, thus excluding any cyberattack that may be classified as cyber terrorism or cyber warfare. “Essentially, this means that any organisation that comes under attack from state-sponsored cybercriminals, in an incident that can be classified as cyber warfare, could find itself without any cover at the present moment.

“These exclusions mean that there is a gap in current cyber insurance coverage, meaning that organisations should bulk up their cybersecurity practices and systems to mitigate their exposure to threats posed by bad actors.”

Cyber warfare is commonly defined as a cyberattack or series of attacks that target a country and has the potential to wreak havoc on government and civilian infrastructure and disrupt critical systems, resulting in damage to the state and even loss of life.

Yet, Van De Coolwijk points out, this is a complex issue, as debate continues among cybersecurity experts as to what kind of activity constitutes cyber warfare. The US Department of Defence recognises the threat to national security posed by the malicious use of the internet but does not provide a clear definition of cyber warfare. Others consider cyber warfare to be a cyberattack that can result in death.

No quick fix

“So, the question of what constitutes cyber warfare revolves around a wide spectrum of philosophical, semantic and legal questions, most of which are not likely to be resolved in the near future. Yet, the implications are more practical and immediate. Whether or not an attack that affects the private sector can be classified as cyber war can have a substantial effect on whether the incident is covered by a cyber insurance policy.”

Van De Coolwijk notes that while there are several examples of alleged cyber warfare in recent history – involving a nation-state perpetrating cyberattacks on another – there is still no universal and formal definition for how a cyberattack may constitute an act of war. This is however changing quickly following the outbreak of war in the Ukraine, with standard definitions and exclusions being developed and rolled out.

In recent months though, insurers have tried to reject cyber insurance claims on the grounds that they constitute cyber warfare, but with mixed success. These attempts at exclusion show that cyber insurers are trying to limit their coverage of these incidents.

In light of this evolving landscape, Van De Coolwijk suggests that companies need to ensure that they are aware of changes in the marketplace of cyber insurance coverage by reviewing their existing policy to see what language is included in the war exceptions. Additionally, organisations must check to see whether their insurer has issued any guidance around these exclusions, and they need to also clearly understand any changes to policy terms during ongoing or upcoming negotiations.

“Until such time as there is some universal agreement on what constitutes cyber war, I suggest policyholders check with the brokers and their policy wording to have a clear view on their possible exposure,” says Van De Coolwijk.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Risk management and compliance enforcement
Security Services & Risk Management
Having a risk management and compliance programme (RMCP) is not just a procedural formality; it is a legal requirement under Section 42 of the Financial Intelligence Centre Act (FICA).

Read more...
The dangers of poor-quality solar cables
Security Services & Risk Management Smart Home Automation
Reports indicate that one in six fires attended by South African firefighters is linked to substandard solar installations, often due to faulty wiring or incompatible components.

Read more...
Growing risks for employers
Security Services & Risk Management
With South Africa’s unemployment rate exceeding 32% and expected to rise beyond 33% this year, desperation is fuelling deception in the job market. Trust is no longer a given, it is a gamble.

Read more...
Chubbsafes celebrates 190 years
Gunnebo Safe Storage Africa News & Events Security Services & Risk Management
Chubbsafes marks its 190th anniversary in 2025 and as a highlight of the anniversary celebrations it is launching the Chubbsafes 1835, a limited edition 190th-anniversary collector’s safe.

Read more...
New law enforcement request portal
News & Events Security Services & Risk Management
inDrive launches law enforcement request portal in South Africa to support safety investigations. New portal allows authorised South African law enforcement officials to securely request user data related to safety incidents.

Read more...
Continuous AML risk monitoring
Access Control & Identity Management Security Services & Risk Management Financial (Industry)
AU10TIX, launched continuous risk monitoring as part of its advanced anti-money laundering (AML) solution, empowering businesses to detect behavioural anomalies and emerging threats as they arise.

Read more...
Growing risks for employers
Security Services & Risk Management
With South Africa’s unemployment rate exceeding 32% and expected to rise beyond 33% this year, desperation is fuelling deception in the job market. Trust is no longer a given, it’s a gamble.

Read more...
Managing mining physical security risks
Zulu Consulting Security Services & Risk Management Mining (Industry) Facilities & Building Management
[Sponsored] Risk-IO, a web app from Zulu Consulting, is designed to assist risk managers in automating and streamlining enterprise risk management processes, ensuring no steps are skipped and everything is securely documented.

Read more...
SAFPS issues SAPS impersonation scam warning
News & Events Security Services & Risk Management
The Southern African Fraud Prevention Service (SAFPS) is warning the public against a scam in which scammers pose as members of the South African Police Service (SAPS) and trick and intimidate individuals into handing over personal and financial information.

Read more...
Rewriting the rules of reputation
Technews Publishing Editor's Choice Security Services & Risk Management
Public Relations is more crucial than ever in the generative AI and LLMs age. AI-driven search engines no longer just scan social media or reviews, they prioritise authoritative, editorial content.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.