When Lindsey Maher (pictured) moved from Canada to London in 2016, she expected the most sophisticated insurance market in the world to have solved cyber’s underpenetration. What surprised her was how much opportunity was still untapped.
London has some of the strongest specialist cyber brokers anywhere, said Maher, now head of global cyber development at CFC, yet she put UK penetration at around 11%.
On whether any market has worked out how to sell cyber to small businesses, she was unequivocal: “No. And I’d be cautious of anyone who says they have.”
Cyber has been around for 25 years and has not come close to its potential. Her estimates put the US furthest ahead at around 30% penetration, while Europe sits below 5%. Some markets have made more progress than others, but the next divide will come down to who can reach small businesses.
The UK’s strength is specialist distribution and the discipline brokers are now bringing to it.
“Over the last year, we’ve seen UK brokers put formal cyber placement strategies in place more so than any other territory globally,” she said. That shows in the volumes of requests for proposals CFC’s teams have received over the past 12 months.
Brokers are testing the quality of their carriers and narrowing their panels to a small number of stable, long-term markets rather than chasing each new entrant. That builds deeper partnerships and product expertise, she said, and frees up time to help clients understand their risk, rather than presenting them with a spreadsheet comparing 40 markets.
Brokers are also recognising cyber as a source of organic growth. Maher said the UK SME cyber market is expected to grow 13% by the end of this year, with cyber growing five times faster than property and four times faster than D&O.
Of UK brokers, she said: “I’d like them to lead with services wrapped around the product rather than the policy wording itself.”
Most small businesses rely on a managed service provider and assume everything is handled, Maher said. Those providers may know IT but lack specialist incident response expertise, such as negotiating with threat actors or obtaining a decryption key. For many small firms, that expertise is what turns a non-buyer into a buyer.
Part of the answer is how relatable events are, Maher said. For years, large corporate privacy breaches were used to sell cyber to small businesses, and they did little for penetration because they did not resonate.
Supply chain events have changed that in the past year or so. She cited JLR, where the Cyber Monitoring Centre estimated around £1.9bn in damage to the UK economy and more than 5,000 UK organisations affected. Many were small suppliers that were never targeted but simply could not trade.
The example shows how small firms can suffer losses without being targeted themselves. When attackers do target them, it is often because they are vulnerable rather than valuable. Competition helps too. The US has more than 200 markets offering a cyber product, and every launch, campaign and new entrant adds to awareness.
“In my view, competition doesn’t shrink the opportunity, it grows it,” Maher said.
Cyber is still treated by many as a discretionary purchase, Maher said, so as lines such as D&O soften, budget that would have gone on those renewals becomes available for what is still a new line for most businesses.
For a long time, cyber was concentrated in the US, followed by the UK, Canada and Australia, with Europe far behind. Europe has seen the biggest shift over the past 12 months, Maher said, but it is a market that has barely started.
Small businesses are the biggest opportunity; they are the backbone of every economy, historically the most underinsured, and rarely have the budgets or specialist teams to defend themselves. Cybercriminals understand that, but the insurance market has not always done so.
The markets that get it right will stop competing only for businesses that already buy cyber and move between carriers and will bring a new generation of buyers into the market instead.
“The ones that don’t will keep recycling the same buyers, and the gap between those two will keep widening,” she said.
The UK has the specialist brokers to be on the right side of that gap, but with close to nine in ten businesses still not buying cyber, it is not there yet.
