Why SMEs Need Cyber Insurance

Almost three-quarters of small and medium-sized businesses have suffered a security breach, and a report from the Federation of Small Business (FSB) says cybercrime targeting small and medium-sized businesses costs the UK an estimated £5.26bn a year. 

The report also notes that it costs small businesses disproportionately more than big businesses, when adjusted for organisational size.

Mike Cherry, National Chairman of the FSB, explains: “Small firms take their cyber security responsibility very seriously, but often they are the least able to bear the cost of doing so. Smaller businesses have limited resources, time, and expertise to deal with ever-evolving and increasing digital attacks.”

Why are smaller businesses a target?

Cyber criminals love smaller businesses because they have more digital assets than consumers, and less security than larger organisations. In fact, the FSB report found that only a quarter of small and medium-sized businesses have a strict password policy, and just 4% have a cyber attack strategy.

Phishing for small business

The most common cybercrimes affecting small and medium-sized businesses are phishing emails, spear phishing emails, and malware attacks. 

Other threats include ransomware (where data is seized and encrypted for ransom), hack attacks (where hackers access the company network), and Denial of Service (DOS) attacks which push a huge amount of data to a company’s website to make it crash.

Phishing emails send you to a website that looks legitimate, and ask you to update your account details. The fraudsters can then easily steal your personal information to commit identity theft.

Spear phishing attacks are even more sophisticated, and harder to spot. They target individuals within the organisation, often mimicking their colleagues, by using email headers and addresses to extort money. 

Statistics from cyber security firm Symantec show more than half of spear phishing attacks last December were against SMEs.

Malware attacks are just as damaging. You might click a link or unknowingly download malicious software designed to infiltrate your computer and steal sensitive information, extort money, or send unwanted advertising (adware).

Spear phishing hooks fishing retailer

Let’s look at a somewhat ironic, real-world example of a cyber-crime event which recently impacted one of our customers. The business, a fishing tackle retailer, was caught out by a spear phishing attack just months after taking out a cyber insurance policy with NIG.

At the time, the company was shopping around for new office space. The account manager received an email from the managing director, asking him to pay £15,000 to a new account, presumably to secure a space. No eyebrows were raised, and the payment was made, however, the email hadn’t come from the managing director. It was sent by a cyber-criminal using a spoof address.

The company quickly alerted the relevant people within NIG. As part of their policy we sent forensic experts to check the fraud came from outside the business, not from an employee, and had the client’s bank put a stop on the account. Their fast action meant only £3,276 was stolen; in part because fraudsters often drip-feed withdrawals in order to avoid detection. The claim was quickly settled, and the retailer could get back to focusing on fishing, and not phishing.

Why take out cyber insurance?

Without cyber insurance, the fishing tackle retailer would have had a different, and far more devastating, experience. After all, the average cost of a cyber breach to small and medium sized businesses is usually between £75,000 and £310,800.

It’s not just stolen funds that business owners have to worry about. There’s also the cost of loss of data and damage to IT systems and networks as well as replacing any stolen or infected devices. There’s the cost of notifying your customers, and in some cases paying compensation, as well as re-building brand confidence through public relations advice and campaigns. 

There’s also investigation and legal costs, money spent responding to regulatory bodies and penalties from banks for losing customer credit card data. On top of all this there is the issue of damaged reputation and lost profit while your system is down. It’s a lot to lose and can often destroy SMEs who don’t have adequate cover in place.

That’s the true value of cyber insurance. It covers you against serious damage, loss of data, and the costs associated with a cyber-attack whilst helping you get back up and running sooner. 

A policy is imperative if your business holds sensitive customer information like names and addresses or bank information, or if you process payments, or do much of your business online. It should also be recognised that your standard business insurance policy probably won’t cover you for cyber-attacks.

It’s clear cyber insurance can minimise the damage caused by a cyber-attack, however, the best policy is to have robust prevention mechanisms in place. This means keeping your IT software and systems up-to-date, training your staff on safe online practices, and implementing formal policies to reduce your risk. 

Putting in place measures such as these, combined with comprehensive cyber coverage, will help keep your business safe from cybercrime.

NIG:

Cybersecurity Breaches Cost UK Businesses £30 billion Last Year:

No Easy Fix For SME Cybersecurity:
 
Cyber Insurance: 7 Questions To Ask:
 
Directors Report January 2017. Cyber Security Checklist For Management (£):

 

« Cybersecurity Breaches Cost UK Businesses Close To £30bn Last Year
Singapore Defense Ministry Under Remote Attack »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

KPMG

KPMG

KPMG s a leading provider of professional services including information technology and cyber security consulting.

Devo Technology

Devo Technology

Devo Security Operations is a next-gen cloud SIEM that enables you to gain complete visibility, reduce noise, and focus on the threats that matter most to the business.

Alan Boswell Group

Alan Boswell Group

We are a Group of Companies providing specialist Insurance Broking and Risk Management advice and services including Cyber Risk cover.

4iQ

4iQ

4iQ fuses surface, social, deep and dark web sources to research and assess risks to people, infrastructure, intellectual property and reputation.

Center for Research on Scientific & Technical Information (CERIST)

Center for Research on Scientific & Technical Information (CERIST)

CERIST is a scientific and technical research centre with activities focused in the area of networks, information systems and IT security.

Quantea

Quantea

Our multi-patented solutions - QP Series Network Analytics Accelerator appliance and PureInsight Analytics Software Suite allows you to capture, analyze, store, replay, network traffic data.

Base Cyber Security

Base Cyber Security

Base Cyber Security is an information and cyber security talent service provider and career specialist.

Industrial Control System Information Sharing and Analysis Center (ICS-ISAC)

Industrial Control System Information Sharing and Analysis Center (ICS-ISAC)

ICS-ISAC is a non-profit, public/private Knowledge Sharing Center established to help facilities develop situational awareness in support of local, national and international security.

Digitale Gründerinitiative Oberpfalz (DGO)

Digitale Gründerinitiative Oberpfalz (DGO)

Digital Founder Initiative Oberpfalz's goal is to build a sustainable start-up culture in the field of digitization throughout the Upper Palatinate district of Bavaria.

Torq

Torq

Torq's no-code automation modernizes how security & operations teams work with easy workflow building, limitless integrations and numerous pre-built templates.

GuardYoo

GuardYoo

GuardYoo's SaaS platform allows cybersecurity professionals to perform Compromise Assessment remotely from anywhere in the world.

Womble Bond Dickinson

Womble Bond Dickinson

Womble Bond Dickinson is a transatlantic law firm, providing high-quality legal experience and outstanding personal service from key locations across the United Kingdom and United States.

Colt Technology Services

Colt Technology Services

Colt Technology Services (Colt) is a global digital infrastructure company which creates extraordinary connections to help businesses succeed.

Sensity

Sensity

Sensity is a company that offers an AI-driven solution to detect and verify deepfakes and other forms of identity fraud.

RightSec

RightSec

RightSec is an emerging market leader and solution provider for cybersecurity and digital resiliency. We provide end to end solutions to suit your specific business lifecycle.

Vantyr

Vantyr

Vantyr's core mission is to safeguard the business-led adoption of SaaS applications by automating the lifecycle management and security of non-human identities.