SMB cyber risk is outpacing insurance-only protection

At a glance

What this is: This is an At-Bay analysis arguing that SMB cyber risk has outgrown a coverage-only insurance model, with ransomware, MSP dependence, misconfigurations and vulnerability pressure widening the gap between loss exposure and protection.

Why it matters: It matters to IAM and NHI practitioners because SMB resilience now depends on access governance, third-party oversight and credential control as much as on policy limits and incident response.

By the numbers:

• At-Bay observed a 46% increase in ransomware claim frequency among companies with $25-$100M in revenue.
• At-Bay observed a 47% increase in severity among companies with $25-$100M in revenue.

Context

SMB cyber risk is no longer a narrow insurance problem. It is a business continuity problem shaped by third-party access, remote connectivity, email reliance and the growing use of outsourced IT, all of which expand the number of places where identity and access controls can fail.

That matters because many SMBs assume that buying cyber insurance closes the gap, when the article shows the opposite: protection often lags exposure, and the operational weaknesses behind incidents are usually still present. The governance challenge is not just transfer of risk, but visibility into who and what can touch critical systems.

Key questions

Q: How should SMBs reduce cyber risk when insurance is only part of the answer?

A: SMBs should treat insurance as a financial backstop, not a control strategy. The practical priority is to reduce attack paths through tighter access governance, better configuration hygiene, and explicit ownership of third-party and MSP privileges. If the business cannot see who has access, for how long, and under what scope, insurance simply absorbs losses after avoidable failures.

Q: Why does IT sprawl create outsized cyber risk for small and midsized businesses?

A: IT sprawl creates risk because each extra tool, integration, and exception makes it harder to see the whole environment clearly. In SMEs, that often leads to weak reporting, missed alerts, and tasks falling through the cracks. Once teams lose shared visibility, attackers can move through gaps that individual tools do not fully cover or correlate.

Q: What do SMBs get wrong about cyber insurance and resilience?

A: Many SMBs mistake buying a policy for having a resilience programme. Insurance can transfer some financial impact, but it does not stop misconfiguration, weak third-party access, or unresolved vulnerabilities. A stronger model uses the insurer’s requirements and services as evidence for internal governance, remediation and board reporting rather than as a substitute for those activities.

Q: How should security teams prioritise vulnerabilities when identity access is part of the exposure path?

A: Start with technical severity, then re-rank issues that sit on privileged accounts, externally reachable apps, or business-critical workflows. A moderate flaw with broad access can be more dangerous than a severe flaw in a tightly isolated system. The best triage model combines vulnerability scoring with access scope, ownership, and expected blast radius.

Technical breakdown

Why SMB exposure grows faster than protection

SMBs often inherit risk faster than they can govern it. Remote access, SaaS sprawl, outsourced IT and rapid software deployment all expand attack surface without always adding corresponding control maturity. In practice, that means security posture is shaped by configuration quality, not just the presence of tools or a policy. For identity teams, the issue is especially acute where third parties and service providers hold standing access into business systems. Once access is distributed across vendors and administrators, the organisation needs lifecycle control, entitlement review and revocation discipline, not just contractual assurances. See the SaaS-to-SaaS and OAuth App Governance Guide.

Practical implication: Treat third-party access as a governed identity lifecycle, not an insurance-covered assumption.

How misconfiguration and vulnerability pressure become attack entry points

The article points to misconfiguration as a fast-growing breach cause and to 40,303 CVEs disclosed in 2024, which together describe a control gap rather than a single technology failure. Misconfiguration turns normal cloud, application or email controls into weak points, while vulnerability volume makes manual remediation unrealistic without prioritisation. The identity angle is that exposed services, over-permissive roles and broken access paths often become the first usable foothold after a technical weakness is discovered. Security programs fail when configuration hygiene and privilege governance are treated as separate workstreams.

Practical implication: Map privileged access and exposed service accounts to the same remediation queue as other high-risk misconfigurations.

Why MSP dependence can hide ungoverned privileged access

Outsourcing does not remove identity risk, it redistributes it. When an MSP becomes the operating layer for a business, the customer often loses day-to-day visibility into who has administrative access, how long that access persists and whether dormant accounts are removed when engagements end. That is a classic governance blind spot because the business still owns the impact of compromise even if another party administers the environment. In NHI terms, MSP-held credentials and delegated access behave like any other high-value non-human identity and should be inventoried, scoped and revoked with the same discipline.

Practical implication: Require full inventory and offboarding for MSP-held credentials, not just contractual security terms.

NHI Mgmt Group analysis

SMB cyber resilience is an identity governance problem as much as an insurance problem. The article is right to treat coverage as only one layer, because most SMB exposure paths still begin with access, delegation or configuration choices that are not governed tightly enough. When third parties, MSPs and SaaS integrations sit inside the operating model, the real control question becomes who can act, on what scope, and for how long. Practitioners should treat insurance as loss absorption, not as a substitute for identity control.

Third-party access is the named governance gap behind much of the SMB risk described here. The article repeatedly points to MSP reliance and supply-chain exposure, which means the weak point is not the contract but the lifecycle of access itself. If a provider can persist with standing credentials, broad admin scope or unclear offboarding, the SMB has outsourced control without outsourcing accountability. OAuth app governance is relevant here because delegated access problems often look different in tooling but the governance failure is the same. Practitioners should inventory and time-bound every external privilege path.

Configuration drift plus credential sprawl creates a compounding control failure. Misconfiguration by itself is not the whole problem, and credential volume by itself is not the whole problem. The issue is that exposed services and over-permissive accounts reinforce each other, which is why recovery costs rise so sharply once an attacker gets in. The article's most useful implication is that SMB security should be managed as a reduction of blast radius, not a binary prevention exercise. Practitioners should align identity scope, configuration hygiene and recovery planning as one program.

Security services bundled with insurance only help if they are operationalised. The article describes assessments, notifications and guidance as available value, but those services only matter when the business turns them into governance actions. That is where many SMB programmes fail: they purchase a control surface but do not embed it into review cadence, remediation ownership or executive reporting. The result is a false sense of protection. Practitioners should convert insurer-provided findings into a tracked remediation queue with named owners and deadlines.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Cyber Resilience Guide

What this signals

SMB resilience now depends on shrinking the gap between loss transfer and loss prevention. Insurance can soften the financial hit, but it cannot compensate for uncontrolled third-party access, exposed services or patch backlogs. The programme implication is clear: if the business cannot reduce privilege scope and configuration drift, the policy only changes who pays after the incident.

Identity-controlled access is becoming a board-level resilience signal. SMBs that can prove MSP privileges, SaaS delegations and service accounts are inventoried and time-bounded will absorb incidents more effectively than peers who rely on contractual assurances. That is why governance teams should treat delegated access as part of business continuity, not just security administration. OAuth app governance becomes relevant wherever external access persists beyond the relationship that created it.

Recovery cost pressure is pushing organisations toward stronger blast-radius management. When even mid-market firms face recovery bills that can overwhelm them, the question is no longer whether prevention is perfect, but whether the environment limits spread once compromise starts. That makes entitlement scoping, service-account containment and third-party offboarding the controls most likely to change outcomes.

For practitioners

• Map all third-party access paths Inventory MSP, SaaS and contractor access to production systems, then classify which accounts are standing, delegated or dormant so you can remove unowned privilege paths.
• Tie cyber insurance requirements to control ownership Translate underwriting questions into an internal control register so every required safeguard has a named owner, review cycle and evidence source.
• Prioritise misconfigurations that expose identity paths Fix the controls that most directly enable initial access, especially remote access settings, privileged roles, public services and exposed integrations.
• Use insurer-provided findings as remediation inputs Treat assessments, alerts and vulnerability notices as queued work items, not advisory documents, and track closure the same way you track material operational risk.
• Reduce blast radius before focusing on policy depth Limit the access scope of service accounts and external administrators so a single compromised path cannot spread into wider business disruption.

Key takeaways

• SMB cyber risk is widening faster than many insurance programmes are adapting, which makes operational control over access and configuration more important than coverage alone.
• The article links rising ransomware losses, MSP reliance and misconfigurations to a broader resilience gap that can affect entire supply chains.
• Practical response starts with tighter third-party privilege management, better configuration hygiene and using insurance requirements as governance inputs rather than substitute controls.

Related NHI Mgmt Group resources: SaaS-to-SaaS and OAuth App Governance Guide · CI/CD Pipeline Identity Security Guide · AI Supply Chain Security and AI-BOM Guide · Cyber Resilience Guide

Key terms

• Third-Party Access Governance: Third-party access governance is the control set that tracks, approves, reviews, and revokes access granted to external vendors and partners. It becomes an identity problem when suppliers operate through shared credentials, delegated workflows, or persistent machine access that outlives the business need.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Cyber Resilience: Cyber resilience is the ability to continue operating, recover, and make safe decisions during and after a cyber incident. It goes beyond backup availability by combining visibility, prioritisation, and restoration discipline so the organisation can restore what matters without amplifying harm.
• Misconfiguration: A misconfiguration is a security setting that is incomplete, overly permissive, or incorrectly applied. In SaaS environments, misconfigurations often involve sharing controls, authentication rules, data access permissions, or external integrations. They matter because many SaaS breaches begin with settings that are technically functional but operationally unsafe.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity control to the broader resilience outcomes their programmes are expected to deliver.