Small Business Cyber Insurance Reality Check: Top Myths Debunked

Back in 2013, a mere 31 percent of organizations recognized the value of cyber insurance, a safety net considered non-essential by the majority. Fast forward to 2023, and the landscape has transformed dramatically—47 percent of businesses now boast a standalone cyber policy, with another 43% incorporating it within broader business insurance plans.

Yet, despite the clear surge in cyber insurance uptake, many small and medium-size businesses (SMBs) are still entangled in a web of outdated myths that skew the perception of its value. Here, we aim to dismantle these myths and prevent them from making cyber insurance an integral part of your business strategy and potentially saving your company from staggering losses.

Myth 1: Cyber Insurance Is Only for Large Corporations

The myth that cyber insurance is solely for large corporations is still prevalent even though it’s far from reality because the days when cybercriminals primarily targeted large corporations have long faded.

In 2023 alone, nearly 43 percent of all cyberattacks were directed at SMBs. Cybercriminals often find SMBs attractive targets primarily because they tend to have limited cybersecurity infrastructure and resources, making them easier prey compared to well-fortified large corporations.

In several cybersecurity incidents, SMBs were targeted as a stepping stone to breach larger corporations, especially when they served as vendors or had some form of online access to the networks of these larger entities.

There have also been instances where vulnerabilities in products or services offered by large corporations have adversely affected SMBs and others downstream. A notable example of this is the Microsoft Exchange breach, which happened in 2021 and affected numerous organizations worldwide that relied on the software for their email and calendaring needs.

Unlike large corporations with abundant resources, the recovery journey for SMBs is usually more challenging. That’s why a cyber incident is cited as the second most challenging type of crisis for SMB leaders, just behind a dramatic fall in sales.

For these reasons, dismissing the notion of cyber insurance as a big-corporate-only affair is a perilous oversight that could potentially cost SMBs not just financially, but also in terms of their reputation and long-term sustainability.

Myth 2: Cyber Insurance Is Too Expensive

Let’s face it, every penny counts when you’re running a smaller business. The budget is often tight, and every expense is scrutinized—as it should be. The reality is that cyber insurance isn’t just another expense. It’s a significant investment towards safeguarding the financial health of your business.

For instance, a medium-sized business could be set back by about $1.6 million just to fix the technical damage caused by a successful phishing attack. This doesn’t even account for other potential costs like legal fees, regulatory fines, or the priceless loss of customer trust. Now, juxtapose this with the cost of a cyber insurance premium, and the scales tip heavily in favor of having that safety net in place.

But don’t just take our word for it. A survey conducted by the Insurance Information Institute revealed that a whopping 97 percent of respondents found their cyber insurance adequate to cover the costs incurred due to cyber incidents. And, according to the Betterley Report, approximately 85 percent of cyber insurance claims are paid out. That’s a reassuring statistic in a world where uncertainties are the only certainty.

So, while cyber insurance does come with a cost, dismissing it as too expensive is a myopic view. The potential financial implications of a cyber incident far outweigh the cost of a cyber insurance policy.

Myth 3: Cyber Insurance Is Unnecessary if You Have Strong Security Measures

The objective of cybersecurity professionals and those who hire them is often likened to constructing a fortress. Lay the bricks meticulously, bolt all doors, and voila, you’re protected. However, this analogy misses the mark. Cybersecurity isn’t a static construct; it’s a relentless race where lagging a beat could land you in the clutches of cyber adversaries.

In this race, there are no rules, so participants on the wrong side of the law are constantly scouting for new zero-day vulnerabilities to exploit and devising new tactics to outpace your defenses. A momentary lapse or a newly discovered vulnerability is all it takes for them to compromise your system.

And sometimes, the threat comes from within, like a disgruntled employee with elevated privileges deciding to go rogue. So, the fact is that no matter how fortified your digital fortress is, there’s always a potential weak spot.

That’s where cyber insurance comes in, adding one last safety net to ensure that the financial fallout in case of losing the race won’t be the nail in the coffin for your business.

Myth 4: Cyber Insurance Policies are All the Same

The misconception that all cyber insurance policies are identical can lead to a false sense of security and potentially inadequate coverage. In reality, the scope and extent of coverage can vary significantly from one policy to another and from one insurer to another.

Here are several areas in which cyber insurance policies can differ:

• Funds transfer fraud coverage: Policies may cover financial losses from fraudulent fund transfers, with varying deductibles and maximum payouts.
• Cyber extortion and ransomware attacks coverage: Some cover ransom amounts only, others extend to digital asset restoration, legal, and reporting fees.
• Service fraud and computer replacement coverage: The range of coverage can vary significantly, encompassing the replacement of compromised devices to covering financial losses stemming from fraudulent use of cloud services.
• Network & information security liability coverage: Range in coverage for third-party claims due to security failures or data breaches, aiding in legal defense and settlement costs.
• Regulatory defense & penalties coverage: Different extents of support in defending against regulatory actions and covering imposed fines or penalties following a cyber incident.
• Exclusions: Policies may have exclusions for certain incidents or liabilities, such as unpatched software or incidents involving third-party vendors.
• Policy limits and sub-limits: Policies have overall limits and may have sub-limits for certain coverages. The adequacy of these in relation to your risk profile is crucial.
• Cost: Premiums vary based on coverage, deductible, cybersecurity posture, industry, size, and geographical operation regions.

Because of these and other possible variations, a thorough examination of what’s being offered is always necessary to select a policy that aligns well with your business’s unique risk profile.

Tip: For a deeper understanding and to make an informed decision, consider reading our guide on what to look for in a cyber insurance policy.

Myth 5: Having Cyber Insurance Makes Businesses a Target

There’s no hard data to support the myth that cyber insurance makes your business a more tantalizing target for cybercriminals—and why would there be?

Cybercriminals are opportunists at heart, seeking to exploit vulnerabilities wherever they find them. Their primary goal is to find weak spots in a business’s digital defenses, and obtaining a cyber insurance policy often involves a thorough cybersecurity assessment to ensure no weak spots are present. So, if anything, having cyber insurance can scare cybercriminals away.

It’s also a stretch to assume that cybercriminals have the means or the inclination to sift through insurance records to find their next victim. In most cases, especially when smaller targets are involved, their modus operandi is to cast a wide net and exploit known vulnerabilities en masse.

Myth. 6: Cloud Computing Model Makes Cyber Insurance Unnecessary

We at OSIbeyond are advocates for cloud computing, and for good reason. It offers scalability, flexibility, cost savings, and accessibility—perks that are especially beneficial for the agility of small and medium-sized organizations. That said, these advantages do not negate the necessity of cyber insurance.

All main cloud computing models (Infrastructure as a Service [IaaS], Platform as a Service [PaaS], or Software as a Service [SaaS]) indeed involve the transfer of some responsibility to a third party, which in many cases is more skilled and better staffed. Nevertheless, the onus of securing, at the very least, the data and user access always lies with the client.

The good news is that most cyber insurance policies define a “computer system” broadly so that the term typically also includes third-party networks contracted to support your company. This means if a breach occurs, regardless of whether the data was on your premises or in a cloud managed by another company, the policy is structured to respond.

However, the fine print matters. Questions often arise about the delineation of responsibilities between your business and the third-party service provider when a breach occurs. It’s critical to understand the extent of coverage and the conditions under which it applies, especially in complex cloud environments.

Myth 7: Good Cyber Insurance Is Easy to Get

Gone are the days when you could just fill out a form and get covered. Insurers are facing an uptick in cyber insurance claims, prompting them to scrutinize applications more meticulously. They’re looking for proof that businesses are not just aware of cyber risks but are actively managing and mitigating them.

Before you even think about premiums and policies, you need to follow a solid cybersecurity program and have all essential controls in place so that you can answer questions like these positively:

• Do you have multi-factor authentication in place?
• How about your incident response plan? Is it tested and effective?
• Can you provide a detailed overview of your current cybersecurity measures and how they align with industry best practices?
• Could you explain your employee training programs regarding cybersecurity awareness and protocol?
• How do you manage and secure sensitive data, especially personally identifiable information (PII) and payment card information (PCI)?

These and other questions are designed to probe the robustness of a company’s cybersecurity defenses and its preparedness for potential breaches, and they’re also the reason why partnering with a proven managed cybersecurity service provider like OSIbeyond is such a good idea when applying for cyber insurance. With the right support and a strong cybersecurity strategy, you can secure a policy that ticks all your boxes.

Conclusion on Cyber Insurance

The world of cyber insurance is full of misconceptions that can deter SMBs from securing the coverage they desperately need. The reality is that cyber insurance is a critical component of a comprehensive risk management strategy, serving as a crucial backstop should other cybersecurity measures fail.

So, don’t let myths cloud your judgment. Connect with OSIbeyond, and we will help you prepare for applying for cyber insurance by assessing your current cybersecurity posture, identifying potential risks, and advising on the best practices to mitigate them.