The Middle East is adding to cyber risk for insurers and reinsurers, with conflict-linked attacks threatening to test underwriting models, war exclusions and operational resilience, S&P Global Ratings has warned.

In a brief published March 11, S&P said cyber‑risk analytics firms have already detected heightened activity from threat actors and affiliated hacktivist groups since the latest round of fighting began. Reported incidents include distributed denial‑of‑service attacks, phishing campaigns and attempts to compromise corporate networks and critical infrastructure.

So far, there have been no public reports of large insured cyber losses directly tied to the conflict, with most events causing disruption rather than sizable claims. But S&P cautioned that cyber activity often intensifies, and can become more destructive, after kinetic hostilities ease.

The agency stressed that the note is not a rating action and that there is “a high degree of unpredictability” around the war’s duration, spillover effects and impact on credit conditions.

Early signs from threat actors

Security vendors have reported spikes in hostile activity around the region following recent strikes and counterstrikes. Threat researchers have pointed to pro‑Iranian hacktivist groups claiming attacks on critical infrastructure and government targets in Israel, the Gulf and North America, as well as probing of data centers and industrial systems.

S&P noted that the dedicated cyber insurance market in the Middle East is still small but expanding rapidly. Globally, cyber premiums are estimated to be in the mid‑teens of billions of US dollars and could more than double by the end of the decade.

Because cyber risk is highly interconnected, a major event in one region can trigger losses across portfolios elsewhere, particularly where insureds share cloud providers, software or supply chains. Recent supply‑chain intrusions have shown how a single compromise can affect thousands of organizations in multiple countries at once.

War exclusions, attribution and systemic risk

The brief highlighted three broad concerns for insurers and reinsurers -- claims uncertainty, systemic accumulation and operational exposure.

War and "hostile cyber operation" exclusions are now common in standalone cyber policies, especially in the London market. But attribution remains difficult when attacks are routed through proxies or loosely aligned hacktivist groups, increasing the risk of disputes over whether an incident is a state-backed act of war (and therefore excluded) or a criminal event that remains to be covered.

Systemic and accumulation risk is another focus. According to the note, attacks on shared services or critical infrastructure can generate simultaneous losses across many insureds, lines and geographies, stressing reinsurance programs and challenging assumptions about diversification. At the same time, carriers’ own operations are potential targets, given their reliance on digital platforms and their holdings of sensitive policyholder and financial data.

Market conditions and the cyber protection gap

The conflict comes against a backdrop of wider debate over cyber war wording.

Since Lloyd’s moved to mandate more explicit clauses excluding catastrophic state‑backed cyber operations and war‑related events, buyers and some regulators have questioned how realistic it is to distinguish cleanly between nation‑state, proxy and criminal activity in practice. Some brokers and managing general agents have sought carve‑backs that restore at least partial cover for “collateral damage” from cyber operations that occur during a war but are not clearly part of the conflict.

Despite the heightened threat, S&P and other analysts still view the overall cyber (re)insurance outlook as broadly stable.

Underwriting results have improved since the ransomware‑driven loss spikes earlier in the decade, helped by tighter terms, higher attachment points and more disciplined risk selection. Competition has increased, particularly in the US, and pricing has flattened or softened for many buyers even as capacity has grown.

At the same time, the global cyber protection gap remains wide, with many organizations uninsured or significantly underinsured relative to their potential cyber loss exposure, the note said.

What S&P will be watching

From a ratings perspective, S&P said it will continue to focus on insurers’ risk management practices, accumulation controls, policy language and operational resilience. Recent cyber incidents linked to geopolitical tensions have not yet had a material impact on insurers’ credit profiles.

But the agency warned that a large systemic attack, or a sustained campaign that blurs the line between war and crime, could increase earnings volatility and test policy wordings where attribution is uncertain.