CFC, the specialist insurance provider, pioneer in emerging risk and market leader in cyber, today launches The Cyber Insurance Disconnect, CFC’s first global research project examining perceptions of cyber risk, preparedness and cyber insurance among small and medium-sized enterprises (SMEs).
The report reveals a significant gap – or disconnect – between SMEs’ awareness of cyber risk and their understanding of the threats they face and the protection available through cyber insurance.
Key findings
Cyber awareness is no longer the challenge. Cyber attacks and data breaches are now ranked as the biggest business risk facing SMEs, ahead of established exposures including property damage, loss of staff and professional errors. Nearly one in two SMEs surveyed list cyber as their biggest risk and nearly three in five have experienced a cyber event in the past three years, demonstrating that cyber is no longer viewed as an emerging threat but as an everyday business concern.
However, despite increased awareness, many SMEs underestimate the specific threats most likely to affect them. Only 30% identify phishing and social engineering as a major threat, while 30% cite ransomware, and just 28% recognise human error as a significant risk. This contrasts sharply with CFC’s data, where ransomware accounts for 64% of cyber claims costs and human error contributes to 75% of cyber claims.
The findings also expose widespread misunderstanding about what comprehensive cyber insurance provides:
74% do not realise it covers incidents related to human error
68% do not realise it includes proactive cyber security protection
61% do not recognise that incident response support is included
68% are unaware that it provides legal and regulatory support
For years, the cyber insurance industry has built a strong understanding of cyber risk from an underwriting and claims perspective. What has been missing is a clearer picture of how SMEs themselves perceive cyber risk, preparedness and protection. This research helps close that gap. Lindsey Maher, Head of Global Cyber Development, CFC
“As one of the first studies to focus specifically on SMEs with revenues below $25 million across global markets, it highlights where understanding aligns with reality and where misconceptions remain. While awareness of cyber risk has grown significantly, many businesses still underestimate the threats most likely to affect them and remain unclear about the support cyber insurance can provide before, during and after an incident."
“For brokers, that presents a real opportunity. Clients are looking for guidance, not just a quote. By helping businesses better understand their exposures and the services available to support resilience and recovery, brokers can play an important role in closing the gap between awareness and action.”
AI adds urgency to the cyber conversation
The research also points to growing concern around artificial intelligence, with 68% of SMEs expecting AI to increase their cyber risk over the next two to three years. While businesses rapidly integrate AI powered tools to remain competitive, AI risk is outpacing cyber insurance adoption. The result is a growing disconnect between AI integration and AI readiness.
Cyber insurance is linked to greater confidence and preparedness
CFC’s report raises a central question – if cyber is recognised as the biggest business risk, why do so many SMEs continue to retain that risk rather than transfer it through insurance?
Indeed, the research identifies a notable connection between having cyber insurance and SMEs’ reported confidence and preparedness. 94% of insured SMEs say they are confident in their ability to manage cyber risk, compared with 61% of those without insurance. Nine in ten insured SMEs report having business continuity plans in place, while they are 23 times more likely to have a formal cyber strategy.
The cyber insurance disconnect is ultimately an education gap. The industry has spent a decade building awareness. The next decade needs to be about converting awareness into resilience. Lindsey Maher, Head of Global Cyber Development, CFC
“That means simpler conversations about what cyber insurance actually does. More focus on outcomes rather than terminology. Better explanation of the services available before and during an incident. Products that continue to evolve alongside technologies such as AI, and much closer alignment between the risks SMEs believe they face and the solutions our industry offers.”
The Cyber Insurance Disconnect is CFC’s first global research project examining cyber risk through the eyes of SMEs. With cyber insurance still significantly underpenetrated among smaller businesses, the study was designed to better understand how customers think about cyber risk, helping brokers engage clients based on their actual perceptions and knowledge rather than industry assumptions.
