You put the exclusion (or even better expressly carve out “cyber damage” from the definitions to avoid defense costs) since your buyers are less likely to have a risk manager who better understands the coverage. I agree with you that the exclusion isn’t necessary, but without it you will continue to have needless coverage litigation

It’s not clear in the article but this ruling seemed to be over the insureds property policy(?). The direct physical loss requirement is pretty clear but carriers should still put on an unambiguous exclusion (which ISO has many). Either way, this is why cyber insurance is available in the market, coverage is typically not found in property or gl policies

This is madness

This is one of those “nice in theory and bad in action”. No one wants to pay for extortions but sometimes you need to do it to get a decryptor.