Small and mid-sized businesses have always had a complicated relationship with cyber insurance. Cost is part of it, but the process itself can be just as difficult. A business starts looking for coverage and suddenly finds itself answering questions about multifactor authentication, endpoint security, backups, privileged access, vendors, incident response and recovery. For a company without a dedicated security team, even understanding what some of those questions mean can become a project.
Insurance Business recently reported comments from a cyber underwriter who argued that insurers themselves may be contributing to slow SME adoption because businesses can face eight or ten pages of technical questions before coverage is even offered. There’s a reasonable argument for simplifying that process, particularly when smaller businesses are being asked questions they may not have the internal expertise to answer. But there’s another side to this that I think is more important.
The difficulty answering those questions may be telling the business something it needs to know.
When a company doesn’t know whether MFA is protecting every important system, whether backups can actually be restored, who has privileged access or how quickly operations could recover from a ransomware event, the problem isn’t really the insurance application. The application has simply exposed uncertainty that was already there.
That’s why we increasingly see the cyber insurance process as more than an insurance transaction. For an SME, it can become an accidental stress test of how well the company understands its own technology environment and whether the controls everyone assumes are working are actually there and functioning as expected.
This becomes particularly difficult for smaller organizations because responsibility is often spread across several parties. The business owner knows how the company operates. An internal IT person or managed service provider understands parts of the technology environment. Different vendors manage applications, cloud services, email, endpoints or backups. The insurance broker understands what the carrier needs. The problem appears when nobody has a complete view of all of it.
Getting through underwriting then becomes an exercise in collecting answers from different people and hoping those answers accurately describe the environment. That may be enough to complete an application, but it doesn’t necessarily tell the business whether it is actually prepared for the event it is trying to insure.
At Third Wave Innovations, this is where we think SMEs need more help. The objective shouldn’t be figuring out what answer belongs in each box. It should be understanding what the insurer is really asking, determining whether the underlying control is actually in place and addressing meaningful gaps before they become either an underwriting problem or an operational one.
That means helping businesses understand their cyber risk before they approach the insurance process, validating the security controls that underwriters increasingly expect and identifying areas where the company may believe it is protected without having much evidence that the protection is actually working. It also means looking beyond individual security controls to understand the technology and third-party dependencies that could interfere with the company's ability to operate during an incident.
This is where services such as continuous security monitoring, managed detection and response, endpoint protection, security awareness and cyber risk assessment can make a practical difference for an SME. They can improve security, but they can also give the business something it frequently lacks when completing an insurance application: evidence. Instead of assuming a control exists because someone configured it two years ago, the company has a clearer understanding of what is deployed, what is being monitored and where gaps remain.
That matters because insurers aren't asking these questions simply to make the application difficult. They are trying to determine the likelihood and potential severity of a loss. As claims experience improves and underwriting becomes more sophisticated, businesses should expect insurers to continue paying attention to the controls that can materially change the outcome of an incident.
The opportunity for SMEs is to use that process rather than simply endure it. If an insurance application reveals that nobody knows whether backups have been tested recently, that is worth fixing regardless of whether the carrier requires it. If the business discovers that it can't clearly explain how an incident would be detected or who would respond, that deserves attention before an insurer ever asks about it.
Cyber insurance remains an important part of managing cyber risk because even a well-protected company can experience an incident. The policy can help absorb financial consequences that might otherwise be extremely difficult for a smaller business to manage. But obtaining insurance and being prepared for an incident are not the same thing, and treating them as though they are can create a false sense of security.
Our goal at Third Wave is to help SMEs close that gap. We help businesses understand their actual cyber risk, put practical protections in place, continuously monitor whether those protections are working and build the evidence they need to have a much more informed conversation with their broker and insurer. The result isn't just a business that is better prepared to answer the cyber insurance application. It is a business that has a better understanding of what it depends on and what could happen if those protections fail.
That changes the insurance conversation considerably. Instead of scrambling to answer underwriting questions during renewal, the business can approach the process with a clearer picture of its environment and the controls protecting it. More importantly, it has done work that matters whether the insurer ever asks about it or not.
Cyber insurance asks whether a carrier is willing to accept some of the financial consequences of a cyber event. We want SMEs to understand whether they can keep operating while those consequences are unfolding.
Helping a business become easier to insure is useful. Helping it become harder to disrupt is considerably more valuable.