For years, cyber insurance providers primarily focused on prevention. To qualify for coverage, businesses were often asked to demonstrate that they had cybersecurity policies and practices in place designed to prevent attacks, such as employee training, password policies, and basic security controls.
That is beginning to change.
As cyber threats become more sophisticated, especially with the rise of AI-enabled attacks, insurers are increasingly looking beyond prevention. They want to know whether a business can respond to and recover quickly from a cyber incident when prevention measures fail. For insurance companies writing cyber policies, cyber resilience is becoming just as important as cybersecurity prevention.
This shift is particularly important for small and medium-sized businesses (SMBs), which are increasingly targeted by ransomware and other cyberattacks. While large organizations often have dedicated cybersecurity teams, many smaller businesses operate with limited resources and expertise. As a result, insurers are placing greater emphasis on whether companies have a plan for managing an incident, restoring operations, communicating with stakeholders, and minimizing business disruption.
SMBs seeking cyber insurance may increasingly be asked to demonstrate that they have documented incident response procedures, data backup and recovery plans, and clearly defined roles and responsibilities for responding to cyber events. Insurers recognize that no organization can prevent every attack. What matters is how quickly a company can contain the damage and get back to business.
Despite the scale of the threat, insurance uptake among small businesses remains strikingly low: only about 10% of SMBs globally carry cyber insurance, according to a report by The Geneva Association, an international association of insurance companies. The figure is lower still among the smallest businesses. What’s more, only 35% of small organizations are confident their cyber insurance will adequately cover potential losses, according to a survey by the World Economic Forum.
Closing this gap will take more than awareness campaigns. SMBs need incentives to invest in basic cybersecurity hygiene before an incident occurs, not just after. Many carriers already offer modular cyber policies that provide firms with tailored coverage options, including protection against enforced shutdowns, fines and penalties imposed by regulators, and losses resulting from cyber-related property damage and business interruption. Such coverage options allow both insurers and businesses to move a step forward towards building cyber resilience.
Insurance is only one piece of the resilience puzzle, and for SMBs operating with limited time, budget, and in-house expertise, closing the readiness gap doesn’t have to mean building capacity from scratch. Nonprofit and industry-led organizations have stepped in to lower that barrier. The Cyber Readiness Institute (CRI), for example, offers free training and practical guidance designed specifically for small and medium-sized businesses, including a step-by-step Incident Response Plan template and a plain-language guide to Cyber Insurance FAQs for Small and Medium Businesses. Resources like these give SMBs a practical starting point, reducing risk before a policy is ever needed, and helping them navigate coverage decisions with more confidence.
As the cyber insurance market evolves, SMBs should view resilience not as an insurance requirement, but as a business necessity. The companies best positioned to secure coverage and protect their operations will be those that can demonstrate not only how they work to prevent cyberattacks, but also how they are prepared to respond and recover when an incident occurs.
Free Guide
Cyber Insurance FAQs for SMBs
A plain-language guide to how cyber insurance works and what to ask before you buy.
Free Template
Incident Response Plan
A step-by-step template for documenting who does what when an incident hits.
