Cyber-insured SMEs 23 times more likely to have formal strategy as ‘education gap’ persists

Nine in 10 cyber-insured SMEs reported having business continuity plans in place and were 23 times more likely to have a formal cyber strategy.

This was revealed in CFC’s latest The Cyber Insurance Disconnect study, published 21 October 2026, which surveyed 501 SME decision-makers in the UK in June 2026 to examine perceptions of cyber risk, preparedness and cyber insurance. 

The report exposed that 94% of insured SMEs said they were confident in their ability to manage cyber risk – compared with 61% of those without insurance.

It also revealed that 74% of respondents did not realise cyber insurance covers incidents related to human error and 68% are unaware it includes proactive cyber security protection.

Meanwhile, 61% did not recognise it includes incident response support and 68% were unaware it provides legal and regulatory support. 

Lindsey Maher, head of global cyber development at CFC, said: “For years, the cyber insurance industry has built a strong understanding of cyber risk from an underwriting and claims perspective.

“While awareness of cyber risk has grown significantly, many businesses still underestimate the threats most likely to affect them and remain unclear about the support cyber insurance can provide before, during and after an incident.

“For brokers, that presents a real opportunity. Clients are looking for guidance, not just a quote. By helping businesses better understand their exposures and the services available to support resilience and recovery, brokers can play an important role in closing the gap between awareness and action.” 

‘Education gap’

The survey also exposed that only 30% of surveyed SMEs identify phishing and social engineering as a major threat, while 30% cite ransomware and 28% recognise human error as a significant risk.

This is despite the report revealing that nearly one in two SMEs surveyed list cyber as their biggest risk and nearly three in five have experienced a cyber event in the past three years.

Maher continued: “The cyber insurance disconnect is ultimately an education gap.

“The industry has spent a decade building awareness. The next decade needs to be about converting awareness into resilience. That means simpler conversations about what cyber insurance actually does. More focus on outcomes rather than terminology. Better explanation of the services available before and during an incident.

”Products that continue to evolve alongside technologies such as AI, and much closer alignment between the risks SMEs believe they face and the solutions our industry offers.”