Small businesses remain one of cyber insurance’s largest coverage opportunities and one of its most persistent sales challenges. The gap has frequently been attributed to owners not understanding why they need the product, particularly when they hold little sensitive data, do not accept online payments or do not view themselves as technology businesses.
Recent US data suggests awareness of the underlying threat is already widespread. An April 2026 Morning Consult survey of 506 US small-business owners found that only 24% carried cyber insurance, even though 63% considered cyber threats a serious problem and 72% said they had experienced fraud, scams or ransomware during the previous year.
Keith Savino (pictured), CEO of Emergence US, believes the way cyber is presented remains part of the difficulty. Conversations focused primarily on hackers, stolen records and privacy liability can feel removed from the day-to-day concerns of smaller companies. Rather, lost revenue, idle employees and unavailable suppliers give agents a more immediate way to demonstrate the exposure to their clients.
“A lot of people focused only on the IT side,” Savino told Insurance Business. “They didn’t focus on questions such as: What if I have 30 employees sitting around doing nothing? What if I have no revenue coming in because I can’t invoice or bill people? What if I can’t sell a product because I can’t obtain it?”
Savino believes the pandemic gave small-business owners a clearer understanding of the financial consequences of suddenly being unable to trade.
The cause of a cyber interruption may be different, but the operational questions are familiar, he explained: employees may be unable to work, revenue may stop because invoices cannot be issued, or production may stall because an assembly line is unavailable.
This framing can help brokers move beyond longstanding misconceptions that cyber insurance is relevant only to companies that sell online, accept credit cards or hold large volumes of personal information. Even businesses with limited customer data may depend heavily on banking access, email, cloud platforms and outside service providers.
Savino said this framing could also help shift clients’ hesitations over obtaining cyber coverage. “All these businesses also went through COVID and understood what it was like to be shut down,” said Savino. “They understood what it was like for a restaurant not to have food delivered or to be unable to have customers walk in.”
The breadth of exposures for SMEs supports Savino’s view that cyber should no longer be treated as a specialist purchase for a limited group of commercial clients. Savino argued that cyber now belongs alongside the coverages agents routinely discuss with every commercial account.
“One of the challenges we’ve always had in the cyber space is that we grew up on the specialty lines side of the conversation,” he said. “Cyber is frankly a standard line. It should be offered to 100% of commercial accounts. We should no longer be asking the question, ‘Who needs cyber?’”
Other barriers to distribution have included lengthy applications, limited agent familiarity and products that may not reflect the needs of smaller companies. However, Savino described current premiums as “readily attainable,” though further growth will depend on whether cyber becomes a routine part of new-business and renewal discussions.
“If you’re a retailer, you need to be offering a cyber insurance solution to 100% of your insureds, 100% of the time,” he said. “If you don’t offer it, they aren’t going to buy it.”
Savino acknowledged the significant opportunities in SME cyber is part of the reason Emergence launched its US operation. The Australian cyber underwriting agency has operated since 2015 and is entering the US with an agent-focused distribution model targeting small and midsize organizations.
Emergence’s initial US appetite extends from start-ups to businesses with up to $250 million in revenue, with automated quoting available for companies below $50 million. Savino said the MGA plans to offer primary limits of up to $10 million for most classes, alongside higher cybercrime limits and per-event rather than annual aggregate limits.
“Because there’s a tremendous amount of new business opportunity, I think you’ll continue to see a lot of competition in this space,” Savino said.
