New research from specialist insurer CFC suggests smaller firms now see cyber as their single biggest business risk, yet most cannot say what a cyber policy actually does for them. The gap between fear and understanding matters for brokers, insurers and every SME board deciding whether to buy cover.
What happened
On 21 October 2026 CFC, the specialist insurer that describes itself as a market leader in cyber, published The Cyber Insurance Disconnect. It is the company’s first global research project looking at how small and medium-sized enterprises perceive cyber risk, how prepared they are and what they believe cyber insurance provides. The study focuses on businesses with revenue below $25 million, a segment CFC says is still significantly underpenetrated by cyber cover.
The headline result is that awareness is no longer the problem. Nearly one in two SMEs surveyed put cyber attacks and data breaches at the top of their risk list, ahead of property damage, professional errors and the loss of staff. Close to 60% reported suffering at least one incident within the last three years, so for most smaller firms an attack is no longer hypothetical.
The problem, CFC argues, is what comes next. Firms know cyber is dangerous but misjudge where the danger comes from, and many have little idea what a policy would do for them before, during or after an incident. The insurer’s head of global cyber development, Lindsey Maher, summed it up as “ultimately an education gap”.
The detail
The most striking numbers concern threat perception. Just 30% of respondents rated phishing and social engineering a serious danger. The same share named ransomware, and only 28% saw staff mistakes as a significant risk. CFC’s own claims book tells a different story: ransomware drives 64% of the money it pays out on cyber, and human error features in three-quarters of claims. The threats SMEs worry least about are the ones driving most of the losses.
Understanding of cover is similarly patchy. According to the global figures:
- 74% did not know a cyber policy responds to incidents triggered by staff mistakes.
- 68% had not heard that cover can include proactive security services.
- 61% did not realise incident response support is part of the package.
- 68% did not know cover extends to legal and regulatory support.
Artificial intelligence adds another layer. Around 68% of respondents think AI will make their exposure worse within the next few years. CFC’s view is that adoption of AI tools is outrunning both risk thinking and insurance take-up.
The report also compares insured and uninsured businesses. Of SMEs holding a policy, 94% felt confident handling cyber risk, against 61% of the uninsured. Nine in ten insured firms had a business continuity plan, and they were 23 times as likely to have a documented cyber strategy. Insurance Business UK rightly notes this is correlation, not proof of cause: better-run firms may simply be the ones that buy cover.
CFC has also refreshed its Cyber Proactive Response product for SMEs, with protection for executives, explicit AI wording and an extended indemnity period for business interruption, and has been adding to its broker-facing cyber team in the UK and Ireland.
Why it matters for UK organisations
Although the study is global, its findings will feel familiar to anyone working with smaller UK businesses, many of which sit in supply chains serving larger firms and the public sector. When a small supplier misreads its own risk, the consequences rarely stay inside its four walls.
There is also a commercial story. The research is aimed at brokers, and CFC says clients want guidance, not just a quote. For UK broking, the edge is shifting from price to explanation: showing an owner that a policy may fund forensic investigators, lawyers and regulatory notification support, not just a lost day’s trading.
For boards, the human error finding should be the uncomfortable one. A cyber policy that covers mistakes by staff is precisely the cover most SMEs need, and three-quarters of them do not know it exists. Directors who have concluded that insurance “won’t pay out because someone clicked a link” may be making a decision on a false premise.
The AI numbers point to trouble ahead. As AI wording enters policies, underwriters will ask how firms use AI tools and what data those tools see. SMEs that cannot answer will find renewals harder.
Expert view
In my experience, the gap CFC describes is real, and it runs in both directions. Smaller organisations often picture cyber risk as a sophisticated, targeted attack. When we test them, the way in is far more mundane: a reused password, a phished mailbox, a remote access service left exposed, or an administrator who approved a prompt they did not understand. That is exactly the human error and social engineering territory the survey says firms underrate.
The finding that insured firms are better prepared deserves careful reading. I would not tell any client that buying a policy makes them more secure. What the application process does, at its best, is force a conversation about backups, multi-factor authentication, patching and incident plans that might otherwise never happen. The value lies in that discipline as much as in the payout.
Nor is insurance a substitute for controls. A business that has invested in the fundamentals buys cover on better terms and, more importantly, is less likely to need it. The real value of this research is that it reflects what SMEs believe rather than what the industry assumes: anyone advising smaller firms should start with the misconceptions, not the threat briefing.
What to do now
- Read your policy, or your quote, properly. Check whether it covers incidents caused by staff mistakes, whether incident response and legal support are included, and how the business interruption period works. Ask your broker to walk you through a realistic scenario.
- Prioritise the threats that drive claims. Phishing, social engineering and ransomware should lead your risk register. Enforce multi-factor authentication on email and remote access, which maps directly to the Cyber Essentials user access control.
- Harden the basics that ransomware exploits. Keep systems patched within Cyber Essentials timescales, remove unused remote services through secure configuration, and keep tested, offline or immutable backups.
- Plan for human error rather than pretending it will not happen. Run short, regular awareness sessions and simple verification steps for payments and account changes, so a single mistake does not become a crisis.
- Write down an incident plan. Know who to call, including your insurer’s breach response line if you have one, and rehearse it once a year.
- Get a grip on AI use. List the AI tools staff use, decide what data they may handle and be ready to explain this to an underwriter at renewal.
Bottom line
CFC’s study confirms that SMEs have stopped asking whether cyber is a real risk. The harder question is whether they understand which risks will hurt them and what help is available. Right now, most do not. Closing that gap is a job for brokers and insurers, but also for security advisers and boards. Fix the basics, understand the cover, and treat insurance as part of a resilience plan rather than a replacement for one.
Sources
- CFC: Cyber is now SMEs’ biggest business risk, but most misunderstand the threats
- Insurance Business UK: SMEs rank cyber their top risk but misread the threats: CFC
- Insurance Edge: CFC Launches The Cyber Insurance Disconnect Project
- Insurance Post: CFC report highlights gap in cyber awareness and understanding
