Staff mistakes contribute to 75% of cyber claims, but businesses are still underinsured.
Small and medium-sized enterprises (SMEs) are underestimating common cyber threats and the protection offered by cyber insurance, despite ranking cyber attacks and data breaches as their biggest business risk, according to CFC.
The specialist insurer’s first global research project, The Cyber Insurance Disconnect, found that only 30% of SMEs identify phishing and social engineering as major threats, whilst 30% cite ransomware and 28% recognise human error as a significant risk.
These figures contrast with CFC’s claims data, which shows ransomware accounts for 64% of cyber claims costs, whilst human error contributes to 75% of cyber claims.
The research also found that many SMEs do not understand the coverage and services available through cyber insurance. Some 72% do not realise that policies can cover incidents involving human error, whilst 71% are unaware of proactive cyber security protection. In addition, 68% do not know that incident response support is included, and 69% are unaware of legal and regulatory assistance.
In Australia, nearly half of the SMEs surveyed ranked cyber attacks and data breaches as their biggest business risk. Seven in 10 had experienced a cyber incident in the previous three years.
The findings suggest that greater awareness of cyber risks has not translated into a clear understanding of the threats businesses face or how insurance can help them respond.
Lindsey Maher, head of Global Cyber Development at CFC, said businesses needed clearer explanations of the protection and support available before, during and after a cyber incident.
She said brokers could help close the gap by guiding clients through their exposures and explaining how insurance could support recovery and business resilience.
Artificial intelligence (AI) is adding to these concerns. Some 77% of Australian SMEs surveyed expect AI to increase their cyber risk over the next two to three years, highlighting concerns about whether businesses are prepared for threats linked to the technology.
The report also found a link between cyber insurance and businesses’ confidence in managing cyber risks. Some 94% of insured SMEs said they were confident in their ability to manage cyber risks, compared with 61% of those without cover.
Nine in 10 insured SMEs also reported having business continuity plans, whilst insured businesses were 23 times more likely to have a formal cyber strategy.
CFC said the findings point to an education gap that the insurance industry needs to address, particularly as smaller businesses adopt new technologies and face changing cyber threats.
The study focuses on SMEs with annual revenues below $25m across global markets. It aims to help brokers better understand how smaller businesses perceive cyber risks and the role of insurance in managing them.