There are not many risks a customer will name as their single biggest threat and then decline to insure. In many markets across the world, cyber is one of them.
The awareness argument - the one brokers have been making to small business clients for the better part of a decade - has largely been won. What has not followed is the sale. Across most developed markets, standalone cyber penetration among small and medium enterprises sits stubbornly in the low teens, and has done for years, while the exposure those policies are designed to cover has gone in the other direction.
The exception is the United States and understanding why it is the exception is more useful to brokers than another threat report statistic about ransomware.
Lindsey Maher (pictured), head of global cyber development at CFC in London, puts US SME penetration at 30 to 40 per cent, against roughly 10 to 15 per cent across comparable markets including the UK, Canada, Australia and New Zealand. Her explanation is market structure rather than client sophistication. More carriers have been selling to American small businesses, harder, for longer.
"They have over 200 cyber markets offering a cyber product in the US," she said.
Most insurance executives would call that oversupply. Maher does not.
"I don't think you can ever be oversaturated when it comes to cyber insurance," she said. "We need people talking about it as much as possible, because that's just growing the market, full stop."
Read next: US cybercrime losses hit $21bn as SMB coverage gap persists
The logic is that distribution density is itself the growth mechanism. More carriers quoting means more conversations, and more buyers converted from a base that is almost entirely untapped. On her account, the obstacles outside the US do not vary much by jurisdiction.
"The objections and the rationale behind that are largely the same as well," Maher said.
Comparing national uptake figures is harder than it looks because most published surveys measure something broader than a cyber policy.
The UK's Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology on 30 April 2026 and drawn from 2,112 businesses, found 47% of UK businesses insured against cyber risk in some form, up from 45% and 43% in the two preceding years. Read quickly, that suggests a market approaching half-covered. The qualifier is "some form", a category that includes cyber bundled inside a wider commercial policy, where limits and triggers can bear little resemblance to a purpose-built wording.
Canada separates the two, and the split is instructive. A survey commissioned by Insurance Bureau of Canada and conducted by Angus Reid among 308 business owners and decision makers at companies with up to 500 employees found 22% carried any cyber insurance and only 12% held a dedicated standalone policy.
That 12% is close to Maher's figure, and it is the number that governs what happens at claim time. Swiss Re's analysis of North American and European data points the same way, putting micro-SME take-up at 5 to 10 per cent and SME take-up at 10 to 20 per cent, in a segment that accounts for around 90% of all businesses globally.
Awareness is not what is holding the rest back. Munich Re's Global Cyber Risk and Insurance Survey 2026, published on 22 April 2026 and drawn from more than 9,500 respondents across 20 countries, found cyber resilience widely recognised by decision makers as a strategic corporate priority.
Read next: Apple launches hub as Anthropic issues connected home AI risk warning
Maher identifies three obstacles instead, and says they travel across borders largely unchanged.
The first is sequencing. Cyber gets deprioritised at the point of sale, pushed to the end of a renewal conversation or left out of mid-term contact altogether. In soft market conditions, where there is pressure to move through renewals quickly, the product that requires the longest conversation is the one most easily postponed.
The second is confidence. Maher argues a perception persists in the broking market that cyber is complicated, or sits outside a generalist commercial broker's scope, at a point when it touches every business on the book.
"That confidence gap for brokers to be able to feel that they can speak to clients has been a gap that we very urgently need to close," she said.
The third sits with insurers. Question sets and application forms built around controls appropriate to a listed corporate are not proportionate to a business with 15 staff.
"20-page application forms is not realistic to expect of any client to fill out in that segment," Maher said.
She says that is changing, with more carriers moving to frictionless digital trading and proactive services in the segment. The legacy of it is a generation of brokers who learned that SME cyber was slow to place.
None of those three obstacles is a national characteristic, which is the encouraging reading of the US anomaly. Nothing about that market is unavailable elsewhere. It reached 30 to 40 per cent through competition, volume of conversations and ease of transacting, not through a cultural predisposition to buy insurance.
The uncomfortable corollary is that the gap will not close on its own. It closes one renewal conversation at a time, in the slot where cyber currently gets skipped.
