Every modern business faces the risk of cyber threats. Since 2018, 7000 U.S. businesses have reported data breaches, and the associated financial losses just keep increasing. In business email compromise attacks alone, the FBI reports that over $43B has been stolen from U.S. companies since 2016. With cyber attacks more a matter of “when” than “if,” it’s imperative for all businesses to be ready.
Large corporations are often at the forefront of implementing comprehensive cyber risk management strategies. Small and medium-sized businesses (SMBs) are less likely to have such protective measures in place, leaving them more vulnerable to cyberattacks. For this reason, investing in cyber insurance is particularly important for SMBs.
In this blog, we’ll outline three big reasons that cyber insurance is a crucial aspect of SMB risk management.
1) SMBs are under threat
While SMBs might have once been able to fly under the radar of cybercriminals, that’s unfortunately no longer true. In fact, a study by Verizon found that 43% of online attacks target small businesses specifically - possibly because a false sense of security tends to make them underprepared. If a business thinks they’re too small for cyberattackers to bother with, they might not take all the necessary steps to protect themselves.
This same misconception can lead SMBs to underestimate the potential impact of a cyber incident. 58% of businesses believe they could “quickly resolve” any cyberattack, but in reality, the average recovery time for businesses is nearly a year. Compounding the problem, less than 25% of SMBs have cyber insurance.
This all adds up to a serious (and sometimes existential) threat to SMBs. Cyberattacks on large enterprises might result in higher overall losses, but it’s SMBs who are more vulnerable to the financial fallout of a data breach or similar incident.
2) Recovering from a cyberattack can be extremely expensive
When cybercriminals strike a business, the road back to normal operations can be both long and costly.
Different types of attacks might have different associated costs, but one thing they all have in common is that costs to the business can be significant. Ransomware attacks, where malicious actors encrypt a company's data and demand a ransom for its release, cost an average of $4.54 million. Destructive attacks, which can lead to the loss of critical data or infrastructure, averaged $5.12 million in damages. Data breaches can be especially devastating: In 2022, the average cost for an individual business to recover from a data breach in the U.S. hit an all-time high at $9.44M.
These costs include more than just directly stolen funds. In the wake of a cyber attack, businesses must repair the damage, recover lost data, bring in experts to determine what happened and how to prevent it, fix the security holes that allowed the attack to occur, and possibly buy new equipment to replace anything permanently damaged. If customer data was stolen in the attack, the business may also need to pay fines or respond to a regulatory investigation. They may also face lawsuits from affected customers, or other legal penalties. As we’ve seen, these expenses can very quickly add up to millions of dollars.
Cyberattack recovery can be a significant undertaking for any organization. For a small-to-medium business without insurance protection, it may be too much to recover from.
3) Cybercrime is here to stay
Cybercrime is a rapidly growing threat that continues to escalate in both frequency and sophistication. According to industry reports, there has been a significant surge in cyber attacks in recent years, across a wide variety of attack types.
In 2022 alone, there was a 61% increase in phishing attacks, in which individuals and organizations are tricked into sharing credentials or other sensitive information that can be used to steal data. Ransom Distributed Denial of Service (DDoS) attacks, where cybercriminals paralyze websites or services until a ransom is paid, experienced a staggering 67% year-on-year increase. And these are only a few examples.
Unfortunately, the trend is unlikely to reverse. As long as the internet plays a central role in business (and in life), cybercriminals will find new ways to try to exploit security holes for financial gain. The best things that businesses can do to protect themselves are to invest in following digital security best practices, and to ensure they have sufficient cyber insurance in case attackers do slip through.
If your business works closely with SMBs on cyber-related matters, you’re uniquely positioned to provide a solution. By adding cyber insurance to your product lineup and offering it to your customers, you can meet their need for additional protection while growing your revenue and deepening your customer relationships.
If you offer cybersecurity services to small to medium businesses and want to learn more about how you can grow your revenue by offering cyber insurance, learn more in our free ebook.