We promised this one twice. Vivian reads the fine print of a cyber insurance policy out loud, clause by clause. Silas says insurers aren’t the villains: exclusions are how the price stays affordable. Daniel says the real trap isn’t in the exclusions at all, it’s in the application you signed in forty minutes.
The clauses read on air are paraphrases of the kinds of exclusions found in the market, not quotes from any named policy, and nothing in this episode is legal or insurance advice. The business-owner scene is a disclosed composite.
In this episode
- The war exclusion and Merck v. ACE American: the New Jersey Appellate Division’s May 1, 2023 ruling that the exclusion did not bar coverage for the NotPetya losses — and why the case then settled without a final answer
- Why Lloyd’s required state-backed cyber-attack exclusions in standalone cyber policies (deadline March 31, 2023), and the attribution problem it hands the policyholder
- Travelers v. International Control Services: an insurer asks a court to rescind a cyber policy over how multifactor authentication was described on the application
- Three more clauses, in plain English: failure to maintain the controls you represented, funds-transfer-fraud sublimits, and “voluntary parting”
- A composite scene of an owner whose answer on the renewal form was true in August and false by October
- Five things to do this week, starting with reading the exclusions page out loud with your IT provider in the room
About the show
All Eyes takes one question the industry is arguing about, puts two people who genuinely disagree in a room, and does not let either off easy. Hosted by Vivian Calloway, with Daniel Ramos and Silas Wray, who argues the other side for a living. New episodes most Tuesdays.
🔊 This podcast uses AI-generated voices. Every voice you hear is AI-generated, including the host. Daniel Ramos's voice is his own, cloned with his written consent. We disclose this at the start and end of every episode. Read exactly how we use AI →
Sources cited on air
- Simpson Thacher; Business Insurance; Claims Journal; DAC Beachcroft — coverage of Merck & Co. v. ACE American Insurance Co., N.J. App. Div. (May 1, 2023) and the January 2024 settlement
- Lloyd’s — Market Bulletin Y5381, state-backed cyber-attack exclusions (August 2022); Insurance Journal and Marsh analysis
- Reed Smith; Lockton; Carrier Management — coverage of Travelers v. International Control Services (C.D. Ill., July 2022)
- Verizon, 2026 Data Breach Investigations Report — share of critical exploited vulnerabilities fully fixed; median time to fix
- Mandiant (Google Cloud), M-Trends 2026 — median dwell time; prior compromise as a ransomware vector; Sophos — out-of-hours ransomware encryption (via Help Net Security)