A senior insurance executive has told a federal parliamentary inquiry that cyber insurance remains affordable for small and medium-sized enterprises (SMEs), even as industry data shows fewer than 4% of small businesses hold a policy.
Brylee Jaghbir, head of cyber at Marsh Risk Pacific in Australia, appeared before the House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations on November 1, 2026. The committee, chaired by Sally Sitou MP, is examining how to make cyber security support more accessible to SMEs across sectors including insurance, healthcare, finance, and education. Its final report is due by March 31, 2027.
Jaghbir opened by referencing a statement from the Five Eyes security agencies, which described cyber risk as “a core business risk and leadership responsibility,” and said Australian SMEs face daily targeting by threat actors.
Read more: Cyber insurance uptake falls as online risks remain widespread
“Threat actors do not discriminate based on business size, they seek out targets of opportunity or targets of choice – SMEs are often targets of opportunity,” Jaghbir said.
Any business holding customer information, financial data, or intellectual property, or one that depends on digital technologies to operate, qualifies as a target, she told the committee.
Jaghbir stressed that outsourcing IT does not shift accountability for data or for the financial, legal, and operational consequences of a breach.
“An external service provider may manage a business’s systems, yet the business remains responsible for its data. And, it is responsible for the financial, legal and operational consequences if that data is compromised,” she said.
The Australian Signals Directorate’s (ASD) Annual Cyber Threat Report 2024-25 underscores that exposure. The average self-reported cost of cybercrime per report for small business rose 14% to $56,600 during the reporting period. For medium businesses, the figure jumped 55% to $97,200. ASD responded to more than 1,200 cyber security incidents in the 2024-25 financial year, an 11% increase on the prior year, and received over 84,700 cybercrime reports at an average of one every six minutes.
According to Marsh’s most recent analysis, cyber insurance rates across its markets decreased by 8% in the latest quarter, following a 6% decline in the prior quarter. Jaghbir said pricing has fallen over consecutive years after difficult market conditions in 2021 and 2022.
Those rate reductions have not translated into broader adoption. The Australian Institute of Criminology’s (AIC) Cybercrime in Australia 2025 report found the share of respondents holding cyber insurance fell from 4.6% in 2024 to 3.7% in 2025, the second consecutive annual decline. An estimated 25% of SME owners surveyed by the AIC said cybercrime had affected their business in the prior 12 months.
“There is a persistent misconception that it is expensive, inaccessible and designed only for large corporates. Cyber insurance continues to be affordable and accessible for SMEs, offering practical support and financial protection when it is needed most,” Jaghbir said.
The disconnect between pricing and penetration presents a question for brokers advising commercial clients: if cost is not the barrier, recent reporting on how email fraud now leads SME cyber claims in Australia and New Zealand suggests awareness and product complexity may be greater obstacles.
Read more: SME cyber insurance uptake stalls everywhere except the US
Ransomware and extortion remain the primary drivers of severe losses, Jaghbir said, particularly in healthcare and the legal sector due to the sensitive data they hold.
She also flagged growing concern among insurers about AI-powered cyberattacks and the risks introduced by broader AI adoption, including governance gaps, data security weaknesses, third-party dependencies, and privacy exposures.
Since May 2025, businesses with turnover of $3 million or more have been required to report ransomware and cyber extortion payments to the ASD within 72 hours under the Cyber Security Act 2024. Enforcement began on January 1, 2026, with civil penalties of up to $19,800.
The Australian Institute of Company Directors (AICD), in its submission to the same inquiry, noted that while cyber insurance can form part of an organisation’s resilience framework, access remains uneven.
“Affordability, exclusions and minimum-security requirements continue to limit access to insurance for many SMBs and NFPs [not-for-profits],” the AICD said.
The institute called for practical, sector-specific training for directors and managers and backed the proposed CyberSmart Hub as a central source of guidance for smaller organisations.
Jaghbir told the committee that the process of obtaining cyber cover itself drives preparedness. Marsh’s application process functions as a self-assessment that helps businesses identify gaps and prioritise investment, she said.
She stressed that cyber insurance does not replace governance, hygiene, or training, but sits within a broader resilience strategy that includes investigation, notification, recovery, and legal cost coverage.
“There should be no mystery around cyber insurance. Like other types of insurance, its job is to get you through your worst day, so you can face a better day,” she said.
With the committee due to report in early 2027, brokers should watch for any recommendations around mandatory cyber standards, disclosure requirements, or incentives that could reshape how cyber insurance demand develops among Australian SMEs.
