Twenty-five years after the September 11, 2001, attacks, terrorism insurance faces a problem at both ends of the market.
The boundary between terrorism, political violence and war is becoming harder to define, while an estimated 95% of UK small and medium-sized enterprises (SMEs) still have no dedicated terrorism protection at all.
That creates two distinct coverage conversations: whether clients have terrorism cover in the first place, and whether the protection they do have responds to the threats businesses now face.
The UK's national terrorism threat level currently stands at substantial, meaning an attack is considered likely, according to MI5's published threat level guidance.
James MacDonald, war and terrorism class underwriter at AEGIS London, said one of the central lessons since 9/11 was the need for insurance coverage to keep pace with a changing threat.
"The methodology, coordination and sophistication of the 9/11 attacks took the entire world by surprise, but we've seen violent actors, both state and non-state, continue to engineer new methods of attack in the two decades or so since," he said.
For much of the Western risk presented to the market, however, assessment remains centred on more traditional exposures, including person-borne and vehicle-borne improvised explosive devices targeting high-profile real estate in major cities. MacDonald said advances in blast-wave modelling were allowing insurers to assess those exposures more probabilistically.
The more difficult issue is where one peril ends and another begins. MacDonald pointed to a widening grey area between terrorism, political violence and war, with politically or ideologically motivated activity potentially resembling civil unrest rather than conventional terrorism.
"We strongly advise clients across the globe to buy a Full Political Violence policy covering the full range of perils from Terrorism, Sabotage and Civil Unrest through to Coup to War & Civil War, to ensure all their potential risks are suitably transferred, in a world where the visibility of violent risk continues to weaken," he said.
The market has already been responding to those boundaries. AEGIS London launched a Lloyd's consortium covering political violence risks up to $100 million last year, while insurers have been reconsidering the boundaries between terrorism, sabotage and civil unrest cover.
MacDonald said cross-border dependencies were another growing concern, particularly where regional conflicts disrupt supply chains or travel. Sabotage against European infrastructure, including suspected state-sponsored activity, is now a greater concern for underwriters than a repeat of a large-scale 9/11-style property loss, which he considers increasingly remote given advances in security and intelligence.
For many smaller businesses, however, the more immediate problem is not where terrorism coverage ends but that they do not have it in the first place.
Andrew Stark, head of underwriting at Pool Re, Britain's government-backed terrorism reinsurer, said the organisation estimates around 95% of UK SMEs remain without dedicated terrorism protection. That is broadly consistent with a Federation of Small Businesses survey cited by Pool Re that put SME take-up at just 4%.
"The events of 9/11 demonstrate not only the devastating consequences of an attack, but the inherent unpredictability of the peril," Stark said.
He said Pool Re was working with brokers to encourage more proactive discussions about terrorism risk and appropriate cover.
One obstacle is perception. Smaller businesses may assume they are too insignificant to be targeted or believe terrorism protection is already included within their standard property insurance.
"As a result, many SMEs remain uninsured without realising it," Stark said.
Pool Re is attempting to address that through its SME Incentive Scheme, which offers member insurers discounted reinsurance pricing in return for embedding terrorism protection as standard, non-removable cover across SME property books.
Asked whether that approach suggested the traditional opt-in model had failed to close the gap, Stark said Pool Re wanted to build on the reach it had already achieved. Pool Re currently covers more than £2.3 trillion of UK assets, according to its latest published asset coverage figures.
"We feel however that we can go further," Stark said, arguing that embedding protection as standard could help bring more businesses inside the terrorism insurance safety net.
The consequences of remaining outside it may not require a business to be directly attacked. Stark identified non-damage business interruption (NDBI) as a particular vulnerability for uninsured SMEs.
"Many SMEs may not suffer any direct physical damage, but they could still be forced to close, lose customers or face severe disruption if police cordons, transport restrictions or other security measures prevent them from trading," he said.
That leaves brokers with a more complicated protection gap than headline terrorism take-up figures alone suggest. For some SME clients, the first question is whether terrorism insurance exists within their programme at all. For businesses that are insured, the question is increasingly whether definitions and covered perils reflect the way political violence, sabotage and state-linked activity are evolving.
Twenty-five years after 9/11, simply asking whether a client has terrorism cover may no longer be enough.
