Fresh research published by the UK Government has warned that many of the country’s smaller businesses are not investing enough in their cyber insurance, risking potentially severe financial impacts as well as extensive recovery times if they suffer an attack.

The report, Insuring Resilience, examines the adoption of cyber insurance by UK SMEs in the face of a rapidly evolving threat landscape, finding that many smaller firms underestimate the severity of current threats, leading them to dismiss cyber insurance as a nonessential cost.

Polling more than 100 SMEs, the results revealed that almost a third (28%) do not think cyber insurance is necessary, despite 69% agreeing that their business faces a moderate to high risk from cyber threats.  

The survey, released by the Department for Science, Innovation and Technology (DSIT), revealed that although 62% of SME leaders have at least some awareness of cyber insurance policies, there is a significant gap in understanding.

Only 8% of SMEs said that the information given by insurers or brokers is clear, while 14% pointed to the complexity of navigating policy documents as a major challenge.

DSIT found that a quarter (24%) of SMEs who purchased cyber insurance did so without being aware of all their options, suggesting that many businesses may have acquired coverage without a clear grasp of their needs.

This confusion has led a significant chunk of the UK’s SMEs to be underinsured, with 35% having no insurance at all.

Adding to the quagmire, 65% of SMEs reported that their companies had to meet specific security requirements to qualify for insurance, with 29% highlighting the difficulty in meeting cybersecurity requirements as a major limitation.

The data shows that 50% were forced to spend between £5,000 and £25,000 to meet the criteria for cyber insurance, and even then, questions remained around third-party requirements and outsourcing, not helped by the fact that just half (48%) of firms said their provider offered any assistance in meeting these requirements.

Cost is also a barrier, with 36% of firms that haven’t purchased insurance saying it was too expensive, and 21% citing high premiums as a challenge to maintaining coverage.     

Recommended reading

• UK Gov Cyber Breaches Survey 2024 | Key Stats and Data
• Report: Cyber Breaches Are Tanking Share Prices
• Cyber-crime Costs to Hit $1.2tn in 2025, New Report Warns

Worryingly, that has led almost half (47%) of firms to ‘self-insure’, meaning that they are relying on their own financial reserves to cover losses from a breach.  While that approach could backfire, with recent data showing the average cost of a cyber-attack in the UK sitting at around £1,205, SMEs are perhaps choosing to gamble on a smaller loss rather than paying out hefty premiums.

“While cyber insurance holds significant promise as a tool for mitigating financial and operational risks, its current adoption among UK SMEs remains limited by several interrelated challenges,” concludes the study.

“Simplifying policy terms, offering tailored and affordable solutions and boosting industry collaboration are essential for cyber insurance to shift from a reactive safety net to a proactive risk management tool, ultimately strengthening the security and competitiveness of UK SMEs.”