The majority of small and medium-sized  enterprises (SMEs) have fundamental misunderstandings around the coverage offered by cyber insurance products.

Specialist cyber insurance provider, CFC has said its latest research highlights the opportunities form brokers and insurers globally to do more to educate SMEs on the benefits that cyber insurance can deliver.

CFC’s research project, The Cyber Insurance Disconnect, examined perceptions of cyber risk, preparedness and cyber insurance among SMEs.

The report revealed a significant gap – or disconnect – between SMEs’ awareness of cyber risk and their understanding of the threats they face and the protection available through cyber insurance.

The insurer said cyber awareness is no longer the challenge. Cyber-attacks and data breaches are now ranked as the biggest business risk facing SMEs, ahead of established exposures including property damage, loss of staff and professional errors. Nearly one in two SMEs surveyed list cyber as their biggest risk and nearly three in five have experienced a cyber event in the past three years, demonstrating that cyber is no longer viewed as an emerging threat but as an everyday business concern.

However, despite increased awareness, many SMEs underestimate the specific threats most likely to affect them. Only 30% identify phishing and social engineering as a major threat, while 30% cite ransomware, and just 28% recognise human error as a significant risk. This contrasts sharply with CFC’s data, where ransomware accounts for 64% of cyber claims costs and human error contributes to 75% of cyber claims.

CFC said the findings also expose widespread misunderstanding about what comprehensive cyber insurance provides:

• 74% do not realise it covers incidents related to human error
• 68% do not realise it includes proactive cyber security protection
• 61% do not recognise that incident response support is included
• 68% are unaware that it provides legal and regulatory support

“For years, the cyber insurance industry has built a strong understanding of cyber risk from an underwriting and claims perspective. What has been missing is a clearer picture of how SMEs themselves perceive cyber risk, preparedness and protection,” said Lindsey Maher, Head of Global Cyber Development at CFC. “This research helps close that gap.

“As one of the first studies to focus specifically on SMEs with revenues below $25 million across global markets, it highlights where understanding aligns with reality and where misconceptions remain. While awareness of cyber risk has grown significantly, many businesses still underestimate the threats most likely to affect them and remain unclear about the support cyber insurance can provide before, during and after an incident.”

“For brokers, that presents a real opportunity. Clients are looking for guidance, not just a quote. By helping businesses better understand their exposures and the services available to support resilience and recovery, brokers can play an important role in closing the gap between awareness and action.”

The research also pointed to growing concern around artificial intelligence, with 68% of SMEs expecting AI to increase their cyber risk over the next two to three years. While businesses rapidly integrate AI powered tools to remain competitive, AI risk is outpacing cyber insurance adoption. The result is a growing disconnect between AI integration and AI readiness.

CFC’s report posed a central question – if cyber is recognised as the biggest business risk, why do so many SMEs continue to retain that risk rather than transfer it through insurance?

The research identifies a notable connection between having cyber insurance and SMEs’ reported confidence and preparedness. 94% of insured SMEs say they are confident in their ability to manage cyber risk, compared with 61% of those without insurance. Nine in ten insured SMEs report having business continuity plans in place, while they are 23 times more likely to have a formal cyber strategy.

“The cyber insurance disconnect is ultimately an education gap,” added Lindsey Maher. “The industry has spent a decade building awareness. The next decade needs to be about converting awareness into resilience.

“That means simpler conversations about what cyber insurance actually does. More focus on outcomes rather than terminology. Better explanation of the services available before and during an incident. Products that continue to evolve alongside technologies such as AI, and much closer alignment between the risks SMEs believe they face and the solutions our industry offers.”