A typical data breach costs an average of $2.4 million to investigate and recover from, according to Forrester Research, with 63% of organizations being breached in the past year. Yet, only 14% of small and medium-sized businesses have coverage limits in excess of $600,000, according to the study. 

“Small businesses are disproportionately impacted by these cyberattacks," says Shawn Ram, head of insurance, Coalition. “As attacks become increasingly automated, it has become easier and more profitable for criminals to target small organizations."

In 2021, “claims severity rose 56% for small organizations with under $25 million in revenue," Ram explains. “We also saw a dramatic increase in claims frequency, with a 40% increase in ransomware attacks and 54% increase in fund transfer fraud attacks." 

As a result, the cyber insurance market is hardening, with carriers raising rates and pulling back on capacity and coverage options as cybercriminals target individuals and businesses alike.

“Underwriting is getting stricter, and carriers are asking for more when it comes to cyber hygiene," says Adam Glaude, director of small commercial product solutions, Liberty Mutual Insurance. “Multi-factor authentication (MFA), in particular, has become essential since the onset of the coronavirus pandemic."

To help fill the coverage gap, here are four strategies agents can use to procure cyber coverage for small businesses:

1) Recognize the risks. In this fast-changing cyber world, clients need to understand the risks they face. “Cybercriminals are opportunistic, particularly when it comes to small businesses," Ram says. “Organizations' technology and processes are far more indicative of their risk than their size or industry—no company is too small to be an enticing financial opportunity for attackers."

Small businesses are considered the low-hanging fruit for hackers because of their lack of security. In an advisory issued in July 2022, CFC Underwriting, a specialist cyber insurance provider, issued a warning about the latest ransomware threat to target small businesses known as “BazarCall." The attack involves the use of a phishing email that tricks a target into phoning a call center where they are then instructed to download malicious software. Once the software is downloaded, hackers can implement undetected ransomware attacks.

Cyber insurance can help clients offset some of these risks with value-added services that are specific to their business or industry and provide business owners with the coverage to recover from a potential cyberattack.

2) Review coverage options. “In many instances, the most cost-effective way for a small business to purchase cyber coverage is via an endorsement on their business owners policy or package policy," Glaude says. “The coverage is often robust, includes many of the same key coverages typically found in a standalone policy and still grants policyholders access to risk management services."

Additionally, as many companies moved to remote work in 2020, organizations found themselves reliant on employees' internet security. “Many cyber policies only consider in-office work and ignore the new components of work that may have employees operating in a different city, state and even country," Ram says. “Some policies do not cover employees using their personal non-company-owned devices—this is a significant gap given the new ways of working." 

Further, ransomware coverage and terms are important considerations when offering a policy or endorsement. “Unfortunately, some policies attempt to limit coverage associated with ransomware, one of the greatest threats facing businesses today," Ram says.

3) Present a package. As with the majority lines of insurance, presenting a complete package to carrier underwriters can help agents acquire a quote. 

“Presenting an insured who is proactive in their cyber preparedness and response is always the best strategy," says Jeff Weaver, assistant vice president, management liability, Selective. “Like any other facet of insurance, having a client who is aware of the exposures and has taken steps to mitigate those risks will always present better than those who don't."

Other ways agents can help keep costs down include “doing a deep dive into the business and truly understanding what their cyber exposure is," Glaude says. “The cost [to insure] a contractor that is just storing a few employee records like social security numbers, for example, is going to be much less than a medical office that is storing patient records or an account that is storing personal financial data."

However, cyber insurance shouldn't be the only line of defense. “Adding value to clients shouldn't be viewed only through the lens of insurance but also with a view toward the education, awareness and tools that can be provided and offered to them that positively impact their cyber protection," Weaver says. “Assisting insureds in implementing necessary authentication and verification provisions is an integral step in any cybersecurity program, especially as it's becoming a requirement for most insurance carriers."

4) Take advantage of carrier resources. “Some cyber insurance carriers provide tools and materials designed to help agents have high quality and granular conversations with their clients about the cyber risks their clients face and about how cyber insurance can mitigate those risks," says Timothy Zeilman, vice president for global cyber products, HSB. 

Risk management tools are also an important aspect of what carriers can provide to their clients. “Agents can add significant value by bringing those tools to their clients and encouraging their clients to use them," Zeilman says.

Olivia Overman is IA content editor.