More than one in three (34%) small- and medium-sized enterprises (SMEs) said they have no cyber insurance coverage, despite more than one in five (21%) having suffered a cyber incident or attack in the past 12 months, a survey by Aviva has found.
The insurer’s SME Pulse survey suggested an increase in cyberattacks in recent months. In a previous Aviva survey in late 2021 and early 2022, 13% of SMEs reported being hit by a cyberattack.
In the latest survey, these incidents include major system failures or outages (8%), theft of funds or phishing (7%), malware infections (6%) and ransomware or extortion attempts (5%). Half of SMEs said they were more reliant on digital systems than before the COVID-19 pandemic, and 44% said that they were reliant on cloud technology.
However, only 8% of respondents had a specific stand-alone cybersecurity policy, and, while many said they were covered through other insurance policies or their IT provider, 10% didn’t know if they had any cyber cover at all.
Among SMEs without cyber cover, 38% said they did not believe they would be a target for a cyberattack, while 27% said it was not relevant to their business. Others said it was too expensive (18%), that they didn’t know cyber insurance even existed (16%) and that they didn’t need it because they spent their money on IT security controls (11%).
“It’s a misperception that because you’re an SME, cybercriminals won’t be interested in you,” said Stephen Ridley, head of cyber at Aviva. “Often, the criminals won’t even know whose system they’ve accessed until they’re in there, and they will look to extract whatever value they can.
“The survey shows many businesses believe they are insured but they need to be absolutely sure their policy will do the job. It doesn’t have to be a completely stand-alone policy, either – at Aviva, we can package our cyber cover as part of a wider commercial combined policy.”
