Topic starter
25/10/2026 11:07 am
TL;DR: SMBs are facing a wider cyber risk gap as MSP reliance and misconfigurations add exposure, At-Bay says. Access governance and configuration hygiene now matter because insurance cannot prevent avoidable failures.
Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “Small Businesses Can’t Afford to Ignore Cyber Risk Any Longer”.
By the numbers:
- At-Bay observed a 46% increase in ransomware claim frequency among companies with $25-$100M in revenue.
- At-Bay observed a 47% increase in severity among companies with $25-$100M in revenue.
Key questions
Q: Why does IT sprawl create outsized cyber risk for small and midsized businesses?
A: IT sprawl creates risk because each extra tool, integration, and exception makes it harder to see the whole environment clearly.
Q: What do SMBs get wrong about cyber insurance and resilience?
A: Many SMBs mistake buying a policy for having a resilience programme.
Q: How should SMBs reduce cyber risk when insurance is only part of the answer?
A: SMBs should treat insurance as a financial backstop, not a control strategy.
Practitioner guidance
- Map all third-party access paths Inventory MSP, SaaS and contractor access to production systems, then classify which accounts are standing, delegated or dormant so you can remove unowned privilege paths.
- Tie cyber insurance requirements to control ownership Translate underwriting questions into an internal control register so every required safeguard has a named owner, review cycle and evidence source.
- Prioritise misconfigurations that expose identity paths Fix the controls that most directly enable initial access, especially remote access settings, privileged roles, public services and exposed integrations.
Bottom line: SMB cyber risk is widening faster than many insurance programmes are adapting, which makes operational control over access and configuration more important than coverage alone.
Glossary terms: Third-Party Access Governance, Blast Radius, Cyber Resilience, Misconfiguration
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
SMB cyber resilience is an identity governance problem as much as an insurance problem. The article is right to treat coverage as only one layer, because most SMB exposure paths still begin with access, delegation or configuration choices that are not governed tightly enough. When third parties, MSPs and SaaS integrations sit inside the operating model, the real control question becomes who can act, on what scope, and for how long. Practitioners should treat insurance as loss absorption, not as a substitute for identity control.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: Start with technical severity, then re-rank issues that sit on privileged accounts, externally reachable apps, or business-critical workflows. A moderate flaw with broad access can be more dangerous than a severe flaw in a tightly isolated system. The best triage model combines vulnerability scoring with access scope, ownership, and expected blast radius.
👉 Read our full editorial: SMB cyber risk is outpacing insurance-only protection
This post was modified 7 days ago by NHI Mgmt Group