A recent Insurance Bureau of Canada (IBC) survey suggested that Canadian businesses are lagging when it comes to cyber knowledge, but CFC has found that its clients in Canada are more interested in cyber extensions than in any other territory in which the product is offered.
Prior to a cyber extension upgrade added last month, more than a third of CFC’s Canadian professions clients were taking up the cyber extension and a large proportion were new cyber coverage buyers. Interest has far outstripped that shown in other countries, including the UK, US and Australia, according to CFC.
IBC research has indicated a knowledge gap among Canadian small businesses, with just 20% having signalled intent to take up some form of cyber insurance cover within the next year.
“We believe that there’s a couple of reasons why there has been a low take up rate in cyber for SME customers in Canada specifically,” Tim Boyce (pictured), CFC head of professions and healthcare, told Insurance Business. “Part of that is driven by the fact that there has been a huge number of attacks but the level of coverage that is afforded under a lot of cyber policies – whether it’s in a package, policy or standalone – still doesn’t necessarily adequately cover the risks and exposures that customers are facing.”
In Canada, healthcare and professionals are two of the most targeted areas when it comes to cyber incidents, according to a CFC claims analysis.
Around 55% of CFC’s professions cyber claims originate from data breaches, theft of funds and ransomware attacks, but Boyce suggested that cover in the wider market may be lacking in some of these areas.
“When I go through the vast majority of other insurance policy forms, they’ve got things like sub limits, or they don’t even offer coverages in these areas,” Boyce said. “So perhaps it’s symptomatic of clients buying a policy and then realizing that it’s not worth the paper that it’s written on, because they haven’t actually got any protection.”
Sixty per cent (60%) of the 305 business owners and decision makers surveyed in the IBC 2023 Cyber Security Survey told the organization that they believed their business was too small to be targeted by cyber criminals.
One of the most common pushbacks that CFC too hears from small businesses is that they think they are too small to be hit by a cyberattack, according to Boyce.
“They think they are too small, which I would say is a misconception because most of those organizations, if not all of them, will have a laptop or they’ll have a bank account,” Boyce said. “They’ll be sending funds to third parties or they’ll be sending invoices out, and if they have an email account they will also be susceptible to phishing attacks.”
There may also be some reticence around the cover based on how it has historically responded to cyber events.
“One of the challenges that a lot of brokers have had previously is that in the early days of cyber, because the threat landscape is changing so frequently, the cyber protection that they were recommending to their customers perhaps didn’t extend and didn’t cover all the risks and exposures,” Boyce said. “We’re now way ahead of those trends.”
The IBC data may paint a concerning picture of small business Canadian cyber risk and inertia, but CFC has seen success with getting its professional services clients to engage with cyber insurance.
Forty per cent (40%) of CFC professions clients – which range from consultants to recruiters to contractors and others across sectors – buy cyber coverage in a package policy, and 80% of these are first-time cyber insurance buyers.
“We’re getting a much better take up rate versus what the IBC survey is suggesting, and that’s increasing quite considerably year on year as well,” Boyce said.
Brokers taking the initiative to educate clients around cyber insurance has been a “core reason” driving higher proportional cyber cover take up in Canada within CFC’s book, according to Boyce.
Other factors could include a more diverse set of industry sectors and budgets compared to other countries.
Vulnerabilities, however, are a “global issue”.
“The resounding issue that we’re seeing across all the different jurisdictions is the threat of ransomware is very prevalent,” Boyce said. “It’s only 17% of all claims by frequency, but it’s a really high claims driver from a severity standpoint, [at] 77% of our claims from professions.”
Reflecting on how small business cyber insurance inertia could be tackled, Boyce pointed to making the cover more accessible and valuable for potential clients. For CFC, this has meant upgrading its cover to include access to its proactive threat intelligence tools, which flag up vulnerabilities and potential compromises, and making it easier for clients that already have a policy to access a cyber add-on quotation.
How can Canadian businesses be better encouraged to take up cyber insurance? Share your thoughts on this and the IBC and CFC findings in the comments below.
