Small and midsize businesses now rank cyber as their biggest business risk, but many misunderstand both the threats they face and what cyber insurance covers, according to new research from CFC.
The specialist insurer’s first global study of small and midsize enterprises (SMEs), The Cyber Insurance Disconnect, focused on businesses with revenues below $25 million. Nearly one in two named cyberattacks and data breaches as their biggest business risk, ahead of property damage, losing staff and professional errors. Nearly three in five had experienced a cyber event in the past three years.
Awareness has not translated into an accurate picture of risk. Only 30% of SMEs identified phishing and social engineering as a major threat, 30% cited ransomware, and just 28% recognized human error as a significant risk.
That contrasts with CFC’s own claims experience. Ransomware accounts for 64% of its cyber claims costs, and human error contributes to 75% of its cyber claims.
The research also found widespread confusion about what cyber insurance does. Some 74% of SMEs did not realize it covers incidents caused by human error. 68% were unaware it includes proactive cybersecurity protection, 61% did not know it provides incident response support, and 68% did not know it offers legal and regulatory support.
“The cyber insurance disconnect is ultimately an education gap,” said Lindsey Maher, head of global cyber development at CFC.
Maher said the industry had spent a decade building awareness of cyber risk, and the next decade needed to focus on turning that awareness into resilience. She called for simpler conversations about what cyber insurance actually does, and more emphasis on outcomes than on terminology.
The study found 68% of SMEs expect AI to increase their cyber risk over the next two to three years. CFC said businesses are adopting AI tools faster than they are adapting their protection, creating a gap between AI integration and AI readiness.
That fits wider research. Hiscox found this month that risk managers at multinational companies see cyber threats and AI-enabled fraud as the strongest combination of connected risks, and as the main drivers of wider business disruption.
Insured SMEs reported much higher confidence. Some 94% said they were confident managing cyber risk, compared with 61% of uninsured businesses. Nine in ten insured SMEs said they had business continuity plans, and CFC said they were 23 times more likely to have a formal cyber strategy.
Those figures show an association rather than cause and effect. Businesses that already take cyber seriously may be more likely to buy insurance in the first place. Even so, insurers increasingly require controls and offer prevention services as part of cover, which can strengthen preparedness after purchase.
CFC has been adding such services to its own products. It recently updated its Cyber Proactive Response policy for small and midsize businesses, adding executive protection, affirmative AI wording and a longer business interruption indemnity period.
For brokers, the findings point to a shift in how cyber is sold. The awareness battle has largely been won, so the challenge now is explaining what the product actually covers. Many SME clients do not know that human error, incident response and legal support are typically included, and those are often exactly the points that tip a decision.
The threat gap is just as useful. When clients underestimate ransomware and human error, brokers can use claims data to show where losses actually come from. With AI adding new uncertainty, reviewing whether policies address AI-driven attacks is becoming part of the conversation too.
