Gavin Shillito, cyber underwriter at rrelentless, explains why businesses need to recognise cyber-insurance is increasingly becoming the last line in cyber resilience.

Even the most advanced cyber defences can’t always guarantee protection, as the Co‑Op’s estimated £206 million loss has shown. Despite significant investment in cybersecurity, a sophisticated social engineering attack still managed to penetrate the system.

It raises a big question for UK businesses: if an organisation like the Co-Op can fall victim to cyber-attacks with a dire financial impact, what chances do SMEs have? Yet one in three still operate without any cyber cover. With the pace of threat technologies outpacing technological defences, it’s clear that cyber insurance can remain the final bastion of defence and a core piece of the resilience puzzle.

Underinsurance among UK SMEs

Many small businesses still dismiss cyber insurance as unnecessary, despite the growing frequency and impact of cyberattacks. The issue isn’t a lack of products or coverage options, especially as we’re currently in a soft market, with often broader coverage and lower premiums. The problem is often a knowledge gap that is holding SMEs back, with many believing they are too small to be hit or that coverage is too expensive for their risk profile.

Education is vitally important, and brokers play a key role in communicating the value of cyber insurance to SMEs. Beyond financial coverage, leading policies support proactive risk management, ensuring SMEs are prepared and supported should the worst-case scenario occur.

Threats evolving faster than defences

New techniques, tools and procedures used by cyber criminals, such as AI-driven phishing, automated ransomware deployment, real-time dark web monitoring and rapidly adapting malware, are outpacing traditional risk assessment models utilised by businesses. In this context, investing only in cybersecurity controls will not be sufficient.

It’s a harsh truth, but one that businesses need to come around to sooner than later: it’s often not a case of if you’ll get hit by a cyber-attack, but when. Companies should consider additional measures they can take in conjunction with robust cybersecurity controls, including incident response plans, backup systems, cyber insurance and staff training.

Lessons from Co‑Op’s cyber incident

The Co-Op case demonstrates that enhanced security infrastructure alone isn’t enough to prevent a cyber breach, nor the financial fallout. The business suffered millions in losses and reportedly wasn’t covered by an insurance policy, highlighting why a robust insurance policy, alongside technical security, is essential in minimising the financial impacts.

A giant like the Co-Op might be able to swallow these costs and gradually get back on its feet, but for an SME, the cost of a cyber-attack is often too much to bear. The average cost of a UK cyber incident now stands at £10,830 for SMEs and exceeds £1 million for larger firms. Insurance can act as a safety net that can make the difference between recovery and collapse.

The financial implications of a cyber-attack may not be apparent from day one, but will compound for as long as it takes for key systems to be back up and running. This can take months, as shown by the recent JLR breach, which required a government loan and intervention. If a business only invests in technical security, it will be left vulnerable once a breach occurs, resulting in business interruption costs, potential technical fixes and possibly legal fees.

The “Trojan horse” reality

I use a ‘Trojan Horse’ analogy when explaining to brokers and customers the need for cover. You can have the highest and thickest castle walls (external security), the largest army (a well-equipped and sophisticated IT department), the best drills (cybersecurity training and policy), and multiple escape routes (system and data backups). However, if a threat actor is unknowingly let in or a gate is left open, and the enemy is in the city, this can all be futile.

Cyber insurance should be viewed as both an essential backstop and a learning opportunity, driving continuous evolution and improvement of the risk profile to maintain cybersecurity against an ever evolving and developing cyber threat. Indeed, some policies make proactive risk management accessible to SMEs through education, additional training and support.

Partnership, not replacement

Cyber insurance can be most effective when combined with robust cybersecurity measures and controls, supported by staff training, clear policies and a comprehensive understanding throughout the organisation.

The conversation shouldn’t be about choosing between cybersecurity and insurance, but rather about learning how to use both to enhance the organisation’s resilience and preparedness in the event of a cyber breach. The two can go hand in hand; a well-designed cyber policy can help to absorb the financial impact following a breach while also incentivising robust security controls through lower premiums and improved underwriting confidence.

Working closely with brokers can ensure that proper education and incident response plans are in place, so that it’s not just about offering financial cover, but genuine resilience.

Takeaways for SMEs

For UK SMEs, the lesson is clear: cyber resilience is not just a technical measure, but also a financial and strategic one. With existing financial pressures due to inflation and economic uncertainty, it’s more important than ever that SMEs set themselves up for success. Robust insurance cover can make the difference between riding the wave and being dragged under. Together, strong technical defences and cyber insurance enable businesses to be prepared for both protection and recovery.