The Australian cyber market has spent years being told SME take-up will improve once the product gets cheaper. It got cheaper but take-up did not move. Now an underwriter says the obstacle sits with insurers, not brokers and not price.
Trent Nihill (pictured), general manager of Coalition Australia, told Insurance Business that the friction brokers report happens well before any premium conversation.
"The challenge often is not necessarily the price of selling it, it's actually getting the quote in the first place," Nihill said.
He said the feedback came directly from brokers he meets at industry events. SME owners acknowledge cyber risk but do not believe it will happen to them and they do not have time to complete eight to 10 pages of cyber questionnaires. The result, on his account, is that brokers cannot get a quote in front of a client at all.
The market data fits that shape. Australian Prudential Regulation Authority (APRA) figures show cyber gross written premium has never exceeded $73 million in a single quarter and stood at $32 million in the March 2026 quarter, less than 0.2% of total industry premium. Those figures cover APRA-authorised insurers only and exclude Lloyd's Australian operations, so they understate total market size but the trend within them is clear. Cyber premiums fell about 10% through 2025 according to EBM's Insurance and Risk's May 2026 market outlook and lower prices have not lifted volumes.
The class is profitable while this happens. APRA recorded positive insurance service results of $17 million, $10 million and $10 million in the September 2025, December 2025 and March 2026 quarters. Cowbell's vice president of underwriting and distribution for the UK and Australia, Claud Bilbao, has put SME cyber penetration in Australia at between 5% and 20%, describing it as a protection gap.
A profitable product, falling prices, flat volumes. Cost is not what is holding it back.
The obvious response is that brokers should do more of the work. Nihill's answer is that they cannot because the information does not sit with the client.
Most SMEs outsource IT to a managed service provider (MSP). A broker can walk a client through what multi-factor authentication means, why it matters and what endpoint detection and response (EDR) involves - and the client still will not have the answer. Without a meeting that includes both the insured and their MSP, Nihill said, it is probably not doable.
"So we're asking complex questions to business owners where it's just not their domain," Nihill said.
Underneath that sits a second problem: the questions assume a binary answer that cyber security rarely produces. Asked whether they have multi-factor authentication across their entire system, most clients are in "yes, but" territory - yes except for these systems, or yes but we have to do it this way. The ambiguity makes both MSPs and insureds wary of answering because they fear a declined claim six months later on what they perceive as non-disclosure. Nihill said that does not really happen but the concern is enough to stall applications.
His conclusion is unusually direct for someone on the underwriting side.
"It's on cyber insurers to ask the questions better, or when the questions aren't required, don't ask them at all," Nihill said.
Coalition has taken the view that the questions are largely unnecessary because better information is available elsewhere. Nihill said Coalition makes no cyber risk questions mandatory on its short application and that what it can find out about an insured independently through its scanning technology correlates better with the risk than the answers clients give on a proposal form.
That is a commercial claim from an interested party. It is also testable and it produces the question brokers should be putting to every cyber market they deal with at the next renewal: if the answers on this form are not what drives your underwriting decision, why is the form eight to 10 pages long?
Any market that cannot answer that is asking a broker's client to do unpaid work for no underwriting purpose and, on the volume figures, losing the sale before it starts.
