Can Small Firms Afford Cyber Insurance?
Cyber cover is getting cheaper, but for small businesses the real cost is getting eligible, and customers are starting to demand it.
Photo: Oksana Demenko on Unsplash
The cyber insurance question, part two of three.
Imagine running a small business with fifteen employees. You have spent years building a customer base, keeping costs under control and gradually introducing technology to make the company more efficient. Your accounts are managed online, customer information is stored in the cloud and most payments arrive electronically.
Then one morning, employees discover they cannot access the company's systems.
Orders cannot be processed, customer records are unavailable and the business is suddenly confronted with the prospect of several days without normal operations. Even if no money has been stolen, the cost of disruption could be considerable.
For many small businesses, the consequences of a serious cyber incident can be difficult to absorb. Unlike larger companies, they may have limited financial reserves, little specialist technical support and no established plan for recovering from an attack.
This is one reason cyber insurance is attracting growing attention across Europe.
But for smaller firms already dealing with rising operational costs, regulatory obligations and economic uncertainty, purchasing another insurance product raises a question. Is cyber insurance becoming an essential part of running a business, or another expense that companies are increasingly expected to bear?
The growing pressure to protect a digital business
The typical European small business has changed considerably over the past decade.
A retailer may depend on an online ordering platform, while an accountancy firm might store client documents through a cloud provider. A restaurant uses connected payment terminals and booking software, and a manufacturer relies on digital systems to coordinate orders and deliveries.
These technologies have helped smaller businesses compete, improve productivity and reach customers beyond their immediate geographical area.
Yet digital dependence also means that an incident involving one relatively ordinary system can disrupt an entire operation.
A successful ransomware attack might prevent employees from accessing company records. A compromised email account could be used to redirect supplier payments, while the failure of an important technology provider could leave a business unable to serve customers.
Some of these incidents may be covered by cyber insurance, depending on the wording of the policy. Others may fall outside the protection purchased.
This distinction matters because businesses are not simply buying protection against hackers. They are attempting to manage the financial consequences of increasingly complex digital operations.
For larger companies, this may form part of an established risk-management process. For a smaller business, the decision can be much more difficult.
What does cyber insurance actually cover?
Cyber insurance is often discussed as though it were a single, standardised product. In practice, policies can vary considerably in the risks they cover, the assistance they provide and the circumstances in which claims will be paid.
A policy may offer access to forensic investigators following a breach, support with recovering data or assistance managing legal and regulatory obligations. Some provide coverage for certain forms of business interruption, while others include protection against specified liabilities involving customer information.
Many policies also include access to incident-response professionals, allowing businesses to obtain specialist assistance without having to find an appropriate provider during a crisis.
For a small organisation with limited technical resources, these services can be particularly valuable.
However, an insurance policy is not a guarantee that every cyber-related loss will be reimbursed.
Coverage may depend on the cause of an incident, the length of the disruption, contractual exclusions and the amount of loss the business must bear itself.
A company may discover that certain incidents involving external technology providers are subject to additional conditions. Waiting periods can apply to business interruption claims, and some policies place limits on the amount payable for particular categories of loss.
The precise terms matter far more than the headline promise of being protected against cyberattacks.
For smaller businesses, understanding those differences can be challenging, especially when they do not have dedicated legal or risk-management teams.
Insurance companies are also asking businesses to improve security
Purchasing cyber insurance increasingly involves more than answering questions about annual revenue and business activities.
Insurers may want to understand how a company protects its systems, manages user accounts, maintains backups and responds to suspicious activity.
A business might be asked whether it uses multifactor authentication, regularly updates software or has controls limiting access to sensitive information.
These questions are commercially understandable. An insurer needs to assess the likelihood of a claim and the potential scale of any resulting loss.
They can also have an influence on the businesses seeking coverage.
Consider a small professional services company that has never formally reviewed its cybersecurity practices. When applying for insurance, it discovers that its existing arrangements may not meet an insurer's requirements.
The company may then have to introduce additional security measures, purchase new software or seek external assistance before obtaining suitable coverage.
This creates an interesting relationship between cybersecurity and insurance.
Businesses may improve their security not simply because of government regulation or a previous cyber incident, but because an insurer expects them to demonstrate that certain protections are in place.
The result could be stronger cybersecurity among smaller organisations. However, it can also introduce additional costs and administrative responsibilities.
There is no universal checklist that every European cyber insurer requires. Expectations differ between providers, policies and business sectors. Nevertheless, insurers are becoming another institution capable of influencing how companies approach digital risk.
Falling prices do not remove every cost
There is some encouraging news for companies considering cyber insurance.
Despite the growing attention given to cyber threats, European cyber insurance prices have been declining.
Marsh reported that cyber insurance rates fell by 9% in the second quarter of 2026, continuing a period of decreasing renewal prices and strong competition between insurers.1
For businesses, this may create opportunities to obtain coverage on more favourable terms.
However, the fact that average insurance rates are declining does not mean every small business will see its premium fall by the same amount.
A company's sector, revenue, previous incidents, security arrangements and requested coverage can all affect the price it receives.
There is also a difference between the quoted premium and the total cost of becoming eligible for insurance.
A business may need to invest in software, staff training, professional assessments or improved technical controls. Some of these measures can provide benefits independently of insurance, but they still require money and time.
For companies operating with narrow margins, those costs matter.
Small business owners also need to consider deductibles, policy limits and what proportion of a loss they would still be expected to absorb.
A relatively inexpensive policy may offer meaningful assistance, but the lowest premium is not necessarily the most appropriate choice.
A market that has not reached everyone
The opportunity to insure against cyber incidents remains unevenly distributed.
Munich Re has highlighted a substantial global cyber insurance protection gap, with many businesses retaining most of their exposure rather than transferring it to insurers.2,3
The gap is particularly relevant for smaller organisations, which may be less familiar with cyber insurance or may consider the cost difficult to justify.
Market Data Forecast predicts that SMEs will become one of the fastest-growing customer segments in Europe's cyber insurance industry, with projected annual growth of 19.1% through 2034.4
That estimate is a forecast rather than a confirmed measure of future adoption. Nevertheless, it reflects why insurers are increasingly interested in developing products for smaller companies.
The commercial opportunity lies in making policies more accessible to organisations that have historically been difficult or expensive to serve.
This might involve simpler products, clearer explanations of coverage or packages combining insurance with basic cybersecurity assistance.
Insurers and technology providers may also be able to reduce administrative costs through more standardised application and assessment processes.
However, accessibility involves more than selling an affordable policy. Businesses need to understand what they are purchasing and whether the protection reflects their actual exposure.
A retailer whose greatest concern is losing access to payment systems may have different requirements from a consultancy handling confidential customer records.
Products that fail to account for those differences risk creating confusion or a false sense of security.
Are businesses being required to buy cyber insurance?
One concern surrounding the growth of cyber insurance is whether businesses may increasingly feel compelled to purchase it.
There is currently no general European Union requirement for every business to hold cyber insurance.
The NIS2 Directive establishes cybersecurity risk-management obligations for organisations within its scope, but it does not make cyber insurance compulsory for all companies.5
Nevertheless, commercial relationships can create their own expectations.
A larger business may ask suppliers to maintain specified insurance coverage as part of a contract. A prospective customer might require evidence of financial protection before allowing a smaller technology company to handle sensitive information.
For some organisations, purchasing insurance may consequently become a practical condition of accessing particular commercial opportunities.
This does not mean every European SME is being forced to buy a policy. It does mean that the decision can increasingly be influenced by customers, suppliers and contractual requirements rather than the preferences of the business owner alone.
The implications could be significant for smaller companies seeking to work with major corporate clients.
Appropriate insurance may help demonstrate professionalism and financial preparedness, but requirements that are poorly matched to the size or activities of a supplier could create unnecessary barriers.
Insurance cannot replace cybersecurity
There is another important limitation.
A cyber insurance policy cannot prevent an employee from opening a malicious attachment, stop an attacker from exploiting an unpatched vulnerability or guarantee that a cloud service will remain operational.
Insurance is principally a mechanism for managing the financial consequences of certain events. Cybersecurity measures are intended to reduce the likelihood or impact of those events occurring.
The two can complement each other, but they serve different purposes.
This is particularly relevant when businesses have limited resources and must decide where to invest.
A company purchasing insurance while neglecting basic security could remain highly vulnerable. Conversely, a business with strong technical protections may still face losses that justify transferring some financial risk through insurance.
The appropriate balance depends on the organisation's exposure, financial circumstances and ability to recover from disruption.
For many smaller businesses, the most useful starting point may be understanding which systems are essential to their operations and what would happen if those systems became unavailable.
That assessment can inform both cybersecurity investments and decisions about insurance.
A new reality for small business
Cyber insurance is becoming more visible within Europe's business environment, but its growing popularity raises questions that cannot be answered by market forecasts alone.
For some SMEs, suitable coverage may provide valuable financial protection and access to expertise they could not otherwise afford. For others, insurance may introduce costs and conditions that are difficult to accommodate.
The industry is responding to a genuine problem. Smaller businesses are becoming more dependent on digital services, often without the financial or technical resources available to larger organisations.
Yet the success of cyber insurance as a small business product will depend on whether insurers can provide coverage that is affordable, understandable and relevant to the customers purchasing it.
As competition increases, businesses may have more opportunities to compare policies and negotiate terms. They may also encounter growing expectations to demonstrate that their own security is in order.
Also in this series: Part one: the market · Part three: the big one.
Corrections: none. If you spot an error, tell us and we will correct it openly.
