Briefing: Cyber risks widen the economy-state protection gap

Never in my lifetime has a defence minister so brazenly declared the UK’s need to prepare for war in 1,000 days. With Wes Streeting’s announcement this week, alongside government advice to stockpile supplies, the UK public is being primed to adjust its expectations for bleaker times.

Let’s hope that this is all just good, sensible risk management and insurance.

But for those of us in the digital economy, it’s like we’re already at war. Cyber is the single most glaring example of the contingent liabilities the UK state is ultimately on the hook for. 

And there’s only one solution to this growing threat I can think of – the Insurer of State.

I’ve long felt the insurance market doesn’t show its true capabilities enough. Like a black bear, we’re not nearly grizzly enough.

That isn’t meant to be disparaging. It’s a call to puff out our chests and acknowledge that our sector could and should help shape the future, rather than merely react to it.

There’s a huge contingent liability gap between what the insurance market covers and what the government is ultimately on the hook for.

In banking and finance, the Bank of England is the big, independent entity we all look to. The fact our sector doesn’t have an equivalent is frankly obtuse, especially when we face systemic risks such as cyber warfare, climate change and pandemics.

When it comes to cyber risk, it’s not like we’ve lacked foresight.

In 2015, Stephen Catlin supported a Z/Yen report that proposed the creation of a government-backed cyber catastrophe reinsurance scheme, with the state potentially acting as insurer of last resort once industry retentions and scheme reserves had been exhausted.

The collective progress on such an initiative, despite similar moves from Pool Re to examine the case for greater public-private collaboration on systemic cyber risk, is worthy of a slow clap.

Public-private schemes tend to emerge when market failure has already become acute. But what we lack is a standing institution capable of appraising these risks and rapidly prototyping a bridging solution.

But we won’t make Cyber Re until we absolutely have to. Pool Re was built remarkably quickly, but it was nine years between the severe floods of 2007 and the launch of Flood Re.

That inconsistency suggests ad hoc State Re creation is disorganised and lacking proper institutional leadership.

Cyber specifics

Nowhere is the need to resolve this war-like grey zone more urgent than in cyber risk.

The insurance market has already had to confront the systemic exposure created by state-backed attacks. Lloyd’s Market Bulletin Y5381, issued in August 2022, required robust wording around war and state-backed cyber attacks in standalone cyber policies, recognising that such losses could exceed what the market is able to absorb.

Unfortunately, attribution is far blurrier than in other classes. The time between an attack and identifying its source can be substantial, while hostile states have every incentive to obscure their involvement.

The National Cyber Security Centre said around 75% of the incidents it managed affecting UK critical national infrastructure and its supporting ecosystem in the year to May 2026 were believed to be linked to hostile state actors.

If I were a cyber underwriter, I’d be meeting the public affairs team every week to say: “It’s not my loss, it’s the government’s, guv!”

And whilst the government might not be liable in the insurable sense of the word, it is always politically and economically exposed.

If a cyber attack collapses a major employer or takes a huge chunk out of gross domestic product (GDP), just as with Covid, all eyes turn to Number 10. So where does that leave insurers?

Until they can prove who carried out a hack, questions of attribution and policy wording remain critical. And what about the government? At some point you have to wonder whether it fully understands the contingent risk it could become politically responsible for.

The most significant recent example set the news cycle alight. 

Al Carns, former armed forces minister, said: “We know the Jaguar Land Rover (JLR) attack was state-sponsored.” 

The problem, as it turned out, was that this was not an official government attribution of the attack.

Carns subsequently clarified that his remark was not based on a Ministry of Defence assessment, saying instead that it was simply “highly unlikely” for an attack of that scale to emanate from somewhere without the host state knowing about it.

That distinction matters enormously. A former minister publicly describing an attack as state-sponsored is politically explosive, even if it does not amount to formal attribution.

It is surely only a matter of time before insurers’ litigators become tempted to test just where the government sits on this hot potato. The stakes are, after all, stacked billions high.

Risk transfer and economic exposure

Where JLR reportedly had no cyber policy in place when the 2025 attack struck, Marks and Spencer (M&S) had transferred part of its cyber risk, with Allianz reported as lead carrier.

JLR reportedly booked around £260m in direct costs from the incident, while the government also provided a £1.5bn loan guarantee intended to support the manufacturer’s supply chain.

Its subsequent restructuring cannot, however, be attributed solely to the cyber attack. The business has also faced tariffs, Chinese competition and wider market pressures.

The contrast still raises an important question, however. When a systemic cyber loss exceeds private insurance, or falls outside it entirely, where does the economic exposure ultimately land?

Thus, we return relentlessly to the need for a new state-level institution sat atop the insurance market. Just as the Bank of England isn’t a bank as we know it, the Insurer of State would not be an insurer as we know it.

Its purpose would be to identify, model and manage the state’s sprawling implicit contingent liabilities before the Treasury is left picking up the pieces – suspension for the car, so to speak, rather than an endless emergency repair bill.

Once such a platform were in place, new reinsurance vehicles such as Cyber Re could be deployed more readily.

Likewise, it could provide the institutional machinery needed to consider state captives or reinsurance structures for other systemic risks where government ultimately carries the can.

All this time, I have been convinced that the echoes of the Covid pandemic made the case for such an institution difficult to deny, subject to economic modelling, of course.

Little did I realise that some of the most compelling evidence has been flashing on our screens the whole time.

It’s always on, it’s always there and it’s always under attack. Let’s not wait another decade for a software update.