SMB cyber risk and insurance: what brokers and teams need to know

TL;DR: SMBs are now more than twice as likely to suffer a cyberattack as a fire and can spend up to four times more on recovery, according to At-Bay, which argues that cyber insurance must shift from passive risk transfer to active resilience support. Coverage alone is no longer enough when MSP exposure, misconfigurations and supply-chain dependence widen the blast radius.

Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “Small Businesses Can’t Afford to Ignore Cyber Risk Any Longer”.

By the numbers:

• At-Bay observed a 46% increase in ransomware claim frequency among companies with $25-$100M in revenue.
• At-Bay observed a 47% increase in severity among companies with $25-$100M in revenue.

Key questions

Q: How should SMBs reduce cyber risk when insurance is only part of the answer?

A: SMBs should treat insurance as a financial backstop, not a control strategy.

Q: Why does IT sprawl create outsized cyber risk for small and midsized businesses?

A: IT sprawl creates risk because each extra tool, integration, and exception makes it harder to see the whole environment clearly.

Q: What do SMBs get wrong about cyber insurance and resilience?

A: Many SMBs mistake buying a policy for having a resilience programme.

Practitioner guidance

• Map all third-party access paths Inventory MSP, SaaS and contractor access to production systems, then classify which accounts are standing, delegated or dormant so you can remove unowned privilege paths.
• Tie cyber insurance requirements to control ownership Translate underwriting questions into an internal control register so every required safeguard has a named owner, review cycle and evidence source.
• Prioritise misconfigurations that expose identity paths Fix the controls that most directly enable initial access, especially remote access settings, privileged roles, public services and exposed integrations.

Bottom line: SMB cyber risk is widening faster than many insurance programmes are adapting, which makes operational control over access and configuration more important than coverage alone.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →