Estimated reading time: 9 minutes
Fewer than one in 10 small businesses in the UK and Europe buy cyber insurance, says Munich Re’s Helga Munger. US adoption may run 20% to 30%. Insurers at a Zywave roundtable called that the market’s biggest opening. The Lloyd’s Market Association is about to publish a plain-English policy built to reach them.
The Zywave Cyber Risk Conference in New York hosted the panel last week. Its title was “From Promise to Payoff: SME Cyber Roundtable.” Munger, Senior Cyber Consultant at Munich Re, moderated. With her were:
- John Keebler, National Cyber Development Leader at CFC
- Chris Mather, Senior Executive, Technical Underwriting at the Lloyd’s Market Association (LMA)
- Jonas Schwade, Chief Executive Officer of cysmo Cyber Risk GmbH
Munich Re and CFC sell cyber insurance. The LMA represents the businesses that underwrite at Lloyd’s. And cysmo sells cyber risk assessments to insurers.
Small Business Cyber Insurance Adoption Is Stuck
Munger recalled a recent talk with a regulator. Insurers matter less to regulators than they think, she said. The reason is how few small firms buy. In the UK and Europe, she said, small-business penetration “is somewhere around 8 to 10 percent.” It is “still relatively low in the US.”
Keebler put US adoption among SMEs “somewhere between twenty and thirty percent.”
The problem isn’t awareness of the threat, he said. “There’s just a fundamental disconnect, frankly, in what’s going on with the market right now.” About half of small businesses rank cyber as their top threat. Three in five have had a cyber event in the past three years. Yet 75% don’t understand that cover would respond to social engineering or a ransomware attack, he said.
Those figures track CFC’s new survey of SMEs with revenue under $25 million, Insurance Business reported. It found 74% didn’t know cyber cover responds to human error. Sixty-one percent didn’t know it includes incident response support.
Many small firms have never been asked. About half of small businesses say no one has offered them cyber insurance, Munger said. She cited Munich Re’s Global Cyber Risk and Insurance Survey. That share has stayed fairly stable, she said.
Munich Re asked brokers at one of its own businesses why they sold so little cyber. Their answer, as she told it: they don’t really understand cyber. They know they can sell property. “So it’s a circular, it’s a hamster wheel that we’re on,” she said.
CINI reported in March that Munich Re sees most cyber incidents and claims hitting micro-companies and SMEs.
The LMA’s First Model Cyber Wording
The LMA publishes model clauses used across the insurance industry, not only at Lloyd’s. A wording with an LMA badge “tends to be the kind of gold standard minimum terms insurance policy,” Mather said.
The LMA has model wordings for virtually every other class of business, he said. It has never had one for cyber. Its members and its cyber insurance committee asked it to write one for the SME market.
Member surveys and academic research pointed to complexity as a barrier, Mather said. Most cyber policies were written for larger commercial buyers. Small regional brokers found the terms hard to understand and hard to explain. Definitions varied so much that brokers struggled to compare one insurer’s policy with another’s.
The work has run well over a year. “We’re very close to publishing our clause,” Mather said. A UK version comes first, followed by US and European versions. The wording will be free for anyone to use. The LMA’s Cyber Business Panel noted progress on “a simplified SME cyber product” as early as November 2025.
The wording is modular, Mather said. A compulsory core covers:
- incident support services
- cybersecurity risk awareness
- restoring systems after an attack
- extortion and ransomware
Everything else is an optional add-on. That includes business interruption, data liability, theft of funds, cybercrime and the downtime of a key customer. “Because we know that budgets are constrained, businesses can choose to add on coverages,” he said.
It is also written in plain English. The aim is a policy brokers can explain. “Why should cyber be any different?” Mather asked. The LMA sets minimum standards and doesn’t mandate limits. Insurers can adapt it.
Munger said Munich Re and CFC both worked on it. She described an alternative to classic business interruption cover: an agreed-value or parametric option for payroll and possibly rent. Small businesses told them making payroll comes first, she said. Crime cover also polled as a priority.
The LMA is also taking the message to regional UK brokers, Munger said. Mather is heading to Belfast to meet brokers there. “We don’t spend as much time as we should with small regional brokers,” she said.
Why Brokers Don’t Sell Small Business Cyber Insurance
Keebler laid out the broker’s math. Generalist brokers earn most of their commission from property, workers’ compensation, and other lines, he said. Cyber premiums there are “de minimis.” Learning a complex product exposes them to errors and omissions claims if they get it wrong.
Time is short too. A broker once told Keebler he had 60 to 90 seconds to present three to five options. Insurers have to do better, Keebler said. They need to “fit our value proposition into a bullet point.”
The industry’s own language doesn’t help. “We can’t even agree if it’s social engineering or funds transfer fraud from policy to policy,” Keebler said. Insurers need room to adapt to new exposures, he added. “Do we really need 10 or 15 or 20 different languages for business interruption or social engineering? Probably not.”
CINI made a similar case in The Lightning And The Lightning Bug, on what cyber jargon costs the industry.
US policy counts include a lot of thin cover. Endorsements bundle small amounts of cyber cover into other commercial policies. In 2025, they made up 62.8% of US cyber policies but 3.9% of premium, CINI reported from NAIC data.
Selling Cyber Like Property
Keebler wants cyber treated as a standard commercial line, bought alongside property, workers’ compensation and auto. He pointed to property insurance. A business with locks, sprinklers and a fire alarm still buys a property policy, he said. “And we need to look at cyber the same way.”
Schwade said the market needs stories. Cyber is “a risk that you can’t see, that you can’t feel, that you can’t touch,” he said. He tells a dentist to treat data like the office door. You lock it every night so a burglar can’t take patient records.
He told the story of buying cover for cysmo itself. The parent company’s CFO saw no need. Its consultants work at client sites. In his view, there was no business to interrupt. Its IT team would protect the data. Then Schwade asked about a widespread event. Could four or five IT staff handle it alone? No, the CFO said. Then Schwade asked which incident response firms would serve first. “The ones with cyber insurance or the ones without cyber insurance?”
That is the real product, Mather said. “Who do they call at three o’clock in the morning?”
Keebler said the industry still needs to answer the cost question. “What’s the cost of not purchasing?” Insurers should tie claim scenarios to each client’s business, he said.
Get The Vyber Insurance News Upload Delivered
Subscribe to our newsletter!
Contracts May Do What Regulators Won’t
No government is going to mandate cyber cover soon, Munger said. She asked whether contracts could act as a soft mandate.
Keebler said that is already happening. “We’re seeing more contracts requiring cyber coverage,” he said. Government work often requires it. He doesn’t expect regulation to step in at scale. “I don’t have a lot of faith in that, call me a pessimist,” he said.
Schwade pointed to Europe, where rules push companies to examine their supply chains. A business could require suppliers to carry cyber insurance, he said. A carrier will have checked that they meet minimum criteria. CINI reported how a two-person vendor’s login reached 8.8 million Danish records.
Buying cover also says something about a business, Keebler said. In CFC’s survey, insured businesses were “vastly more likely to have their own incident response plan.” They also felt far more confident. Ninety-four percent of insured SMEs said they could manage cyber risk, against 61% of uninsured ones.
The Services Small Businesses Don’t Use
Insurers bundle services into small-business policies. Many small clients don’t see the value, Schwade said. He compared it to a premium credit card. Cardholders pay a high fee because travel and dining credits offset it. Cyber services are harder to sell, he said. Insurers first have to explain what awareness training or managed detection and response is.
Mather sees an advantage. Policyholders can use the services from day one, he said. “They don’t have to have a claim to use these services.”
Can Small Firms Qualify For Cyber Insurance?
Selling more cover means little if small firms fail underwriting, Schwade said. “How many of them are having MFA, how many of them are doing regular backups?” he asked. Being offered cover and then declined is “a frustrating experience.”
IT teams find MFA the hardest control to run, a Kaseya survey found. CINI’s list of cyber insurance requirements starts there.
Munger said the market missed this end of the business while cyber boomed. “Maybe when the going was good and cyber was growing exponentially, we didn’t pay enough attention to the small-end market.” Small businesses matter to the resilience of whole communities, she said. “So it’s time for us to change angle, I think.”
FAQ – Small Business Cyber Insurance
How many small businesses buy cyber insurance?
Munich Re’s Helga Munger puts small-business take-up in the UK and Europe at about 8% to 10%. CFC’s John Keebler estimates US SME adoption at 20% to 30%.
Why don’t small businesses buy cyber insurance?
Many don’t know what it covers. About half say they’ve never been offered it. Generalist brokers often find cyber hard to explain and earn far more from other lines.
What is the LMA model cyber wording?
The Lloyd’s Market Association is close to publishing its first model cyber wording, built for SMEs. It is modular, written in plain English and free for any insurer to use.
What does the LMA SME wording cover?
A compulsory core covers incident support, risk awareness, system restoration and extortion. Business interruption, data liability, theft of funds and key customer downtime are optional add-ons.
When will the LMA SME cyber wording be available?
The LMA says it is very close to publishing. A UK version comes first, followed by US and European versions.
Do contracts require cyber insurance?
Increasingly, panelists said. More contracts require suppliers to carry cyber cover. Government work often requires it too. Panelists don’t expect a government mandate soon.
Related Cyber Insurance Posts
- IBM’s Quantum Safety Lead Doesn’t Expect A Cyber Catastrophe. If One Comes, He’s Watching Payments.
- Lloyd’s Market Association Releases Framework for Systemic Cyber Risk Mitigation(Opens in a new browser tab)
- CFC Cyber Development Team Expands U.S. Cyber Insurance Operations(Opens in a new browser tab)
- Trustify Adds Datasurance Cyber Insurance Policy To Trust365 For MSPs(Opens in a new browser tab)
- Companies Are Buying Cyber Insurance & Making (Repeat) Claims, But Ransomware Is Not Covered By About 30% of the Policies: Delinea Survey(Opens in a new browser tab)