AM Best: Small businesses carry greatest cyber insurance exposure

By Mia MacGregor

March 4 - (The Insurer) - Small and medium-sized businesses with annual revenue under $10 million carry the majority of cyber liability exposure across the world, according to a new report from AM Best.

The report, based on responses to AM Best’s inaugural cyber questionnaire, includes data from 41 of the 60 largest cyber insurers worldwide. Collectively, these participants account for approximately $8 billion in total premiums, or about half of the estimated global cyber insurance market.

Findings show that the majority of cyber insurance limits are allocated to small businesses, which make up more than 80% of all cyber policies. As a result, the overall exposure on any one policy tends to be relatively low, the report noted.

However, AM Best also pointed to the systemic risk posed by cyber insurance.

“To the extent that any of these small businesses could be using the same cloud service, or another common service, illustrates how one outage or attack would impact several policies,” the report stated.

While small businesses hold the most policies, larger corporations remain prime targets for cyberattacks due to their financial resources and extensive customer data, according to AM Best.

These companies account for nearly 30% of the total cyber insurance premium, the report found.

Additionally, the report noted that ransomware has emerged as the most common type of claim due to its quick payouts to attackers.

The report also revealed that a majority of reported claims were initially classified as “unknown” coverage types, though AM Best expects this figure to decline as insurers refine their claims classification systems.

Among claims with a specified coverage type, more than half were categorised as “incident response”. AM Best noted that this aligns with the frequency of ransomware attacks and business email compromise.

The report also highlighted that, on a per-claim basis, business interruption claims tend to be more costly than incident response claims.

AM Best emphasised the importance of strong cybersecurity practices, including maintaining reliable backup systems, timely patching, and network segmentation to enhance resilience against cyber threats.