Authors: Barry Jones Munish Mehta
Organisations in the MEA region are rapidly digitising, adopting smart grids, IoT-enabled construction equipment, connected operational technology (OT) and reliance on 3rd party project management software. But this increased connectivity also creates a broader attack surface. A malicious actor targeting OT systems can disable safety controls, manipulate critical machinery or trigger fires and explosions. The result? Tangible property damage losses and significant loss of income, combined with considerable management time to effectively manage and mitigate the situation.
Why traditional policies may leave you exposed
Property ‘All Risk’ and Construction ‘All Risk’ policies primarily cover static-centred physical damage and loss of income due to fire, flood and other traditional perils. However, these policies often fail to account for the physical or material impact of cyberattacks, as well as the resulting revenue and time losses. This narrow view creates hidden exposures, especially in industries reliant on OT and software usage.
When cybercriminals target OT systems, the consequences are real-world: halted production lines, damaged equipment, infrastructure breakdowns and even threats to life. Property and Casualty (P&C) insurers are beginning to acknowledge these risks, but rather than expanding protection, many are introducing exclusions that limit or typically exclude cover for events like fires, explosions or floods triggered by cyber incidents.
As a result, organisations may unknowingly operate with critical coverage gaps and insufficient resources to manage and mitigate such an event, putting them at risk of substantial financial losses during a cyber incident.
Real-world impacts: When digital breaches become physical events
In 2017, a malware attack called Triton occurred in the region where cybercriminals infiltrated a petrochemical facility’s safety system. The malware was capable of shutting down critical safety mechanisms, which could have led to a catastrophic explosion. While no physical damage occurred, it served as a stark warning that cyber threats can have deadly consequences.
Attacks like Shamoon, which disabled over 30,000 computers at an oil and gas facility, forced operational slowdowns and exposed the fragility of IT/OT integration, especially in energy firms relying on legacy industrial systems.
The region’s construction sector is increasingly digitised, particularly in the Gulf. From smart buildings in Dubai to mega-projects in Saudi Arabia, construction is now powered by digital twins, IoT sensors and automated equipment. A ransomware attack on these systems can cause crane malfunctions, shutdowns of critical processes and costly project delays – all with direct property, income loss and liability implications.
With many regional governments investing heavily in smart city infrastructure, building management systems (BMS), IOT devices, elevators, HVAC and energy controls are now digitally linked. A targeted cyberattack on a high-rise’s smart system could lead to overheating, bursting pipelines or fire, with damages that traditional insurance policies are likely to now exclude if the root cause is cyber-related. Some instances of these exclusions can be found in London market clauses, such as LMA 5410.1
Industries reliant on Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) are especially vulnerable to the convergence of cyber risk and physical damage. Sectors such as manufacturing, energy, transportation and hospitality depend on complex digital environments that, if compromised, can result in severe disruptions, financial losses and even personal injury.
In the energy sector, targeted attacks on grid controls could result in major outages across businesses, homes and critical services. The transportation industry is similarly at risk; attacks on smart traffic control systems or automated logistics platforms could lead to accidents, service disruptions and increased operational risks.
The threat is no longer hypothetical. It is happening, and organisations must be ready.
The rise of cyber exclusions in P&C insurance cover
Traditional P&C policies can leave organisations financially exposed as they typically cover physical damage only when caused by insured perils, not cyber-originated incidents. Furthermore, loss of income coverage would not be triggered if the cause of operational downtime is cyber-related. Clients often assume, “if it breaks, we’re covered,” without realising that breakdowns resulting from cyber incidents are typically excluded unless specifically endorsed.
There has been a rise in cyber exclusions in P&C insurance cover over the past few years as the number and frequency of cyber-related incidents have increased. In response to systemic risk, many global insurers have implemented explicit cyber exclusions in property policies (e.g., LMA5401). Reinsurance pressures have accelerated this shift in the MEA market, even though awareness among insureds remains limited. As a result, organisations face growing silent cyber risk exposures that are not clearly covered or more usually fully excluded.
Cyber recovery: A long road without cover
Without appropriate cyber cover, recovery from an event can be financially devastating and time-consuming:
- Asset replacement (machinery, control systems)
- Delays in project handovers, causing loss of income and contractual liabilities
- Regulatory fines or penalties during an audit by the authorities
- Crisis management - Incident response costs (IT security and forensic costs, crisis communication costs, legal and regulatory costs)
- Delays in claims processing also arise when insurers debate the origin of the loss — cyber vs. mechanical
- Loss of reputation and trust – how much would this really hurt your business, not just the direct physical damage and loss of income, but the loss of trust and reputation?
The above costs, losses, expenses and expert support are now usually excluded under property or engineering policies.
Risk mitigation strategies: Bridging the gap
- Review existing P&C and engineering policies to understand where cyber exclusions apply
- Conduct cyber risk assessments specifically targeting OT and IoT environments
- Engage with experts who understand the regional regulatory frameworks and industry-specific exposures
- Adopt compliance-aligned controls based on UAE NESA, KSA NCA/SAMA and ISO/IEC 62443 frameworks
- Seek alternative risk mitigation products, i.e. standalone cyber insurance to ensure no gaps exist and that you would receive the necessary expertise and support in the event of a cyber incident
How Gallagher can help
As cyber threats grow in complexity, businesses must carefully review their insurance risk management framework to identify potential coverage gaps. Insurance advisors are responsible for responding to this risk convergence. Gallagher is at the forefront of providing innovative solutions to address these potential coverage gaps.
With Gallagher’s expertise, businesses can effectively manage and transfer risks related to cyber-induced events, as our advisors:
- Educate clients on where traditional policies end and cyber insurance begins
- Introduce hybrid or bundled coverage solutions that explicitly protect against cyber-triggered property damage, business interruption and OT system failure
- Provide crucial support after a cyber incident, such as expert guidance and assistance in managing the situation and safeguarding reputation
- Collaborate with our internal cyber risk specialist and risk engineers to tailor coverage to the unique threat landscape in high-risk sectors like energy and construction
- Offer a 360-degree risk management framework where we identify, transfer and manage cyber risks while adapting to the changing cyber landscape
Contact one of our specialists to learn more about our solutions and ensure your organisation is protected against physical damage caused by cyber incidents.
