Cyber risk tops SME concerns but insurance knowledge gaps remain: CFC

Cyber attacks and data breaches are now the biggest business risk facing SMEs, but significant gaps remain in understanding both the threats they face and the protection cyber insurance provides, according to CFC.

Its “Cyber Insurance Disconnect” report found nearly one in two SMEs rank cyber as their biggest business risk, ahead of property damage, loss of staff and professional errors.

Almost three in five respondents said they had experienced a cyber event during the past three years.

However, only 30% identified phishing and social engineering as a major threat, while 30% cited ransomware and 28% recognised human error as a significant risk.

CFC said this contrasted with its own claims data, where ransomware accounts for 64% of cyber claims costs and human error contributes to 75% of cyber claims.

Lindsey Maher (pictured), head of global cyber development at CFC, said: “While awareness of cyber risk has grown significantly, many businesses still underestimate the threats most likely to affect them and remain unclear about the support cyber insurance can provide before, during and after an incident.”

The research found 74% of SMEs did not realise cyber insurance covers incidents linked to human error.

Some 68% were unaware policies can include proactive cybersecurity protection, while 61% did not recognise incident response support as part of the cover and 68% were unaware of legal and regulatory support.

AI increases pressure

CFC also found 68% of SMEs expect artificial intelligence to increase their cyber risk over the next two to three years.

The insurer said growing adoption of AI-powered tools was outpacing cyber insurance take-up, creating a widening gap between AI integration and preparedness.

The research also found a significant difference in reported confidence between insured and uninsured SMEs.

Some 94% of insured SMEs said they were confident in their ability to manage cyber risk, compared with 61% of uninsured businesses.

Nine in 10 insured SMEs reported having business continuity plans in place, while CFC said they were 23 times more likely to have a formal cyber strategy.

Maher said: “The cyber insurance disconnect is ultimately an education gap.

“The industry has spent a decade building awareness. The next decade needs to be about converting awareness into resilience.

“That means simpler conversations about what cyber insurance actually does. More focus on outcomes rather than terminology. Better explanation of the services available before and during an incident.”