Cyber risk is now a board issue — but concern is not control
Cyber risk has moved decisively beyond the IT department. The recent report covered by Intelligent Insurer, drawing on WTW and CFC, indicates that cyber risk is high on board agendas while practical preparedness continues to lag. For UK small and medium-sized enterprises, that gap matters more than the boardroom language may suggest.
A director may correctly identify ransomware, invoice fraud or a supplier breach as a serious threat, yet the business can still be exposed if it has no tested incident plan, no reliable offline backups, unclear access controls or an insurance policy that does not match its actual operations. Awareness is valuable, but it does not restore systems, handle a data breach notification or keep wages paid when the firm cannot trade.
The central message for SME owners is therefore straightforward: cyber risk should be treated as an operational resilience issue. It affects revenue, customer trust, contractual obligations, regulatory responsibilities and the ability to continue trading after an attack. Cyber insurance can play an important role, but only when it sits alongside sensible technical and organisational controls.
Why preparedness often falls behind board-level concern
SMEs face the same attack methods, with fewer resources
Attackers do not need a large enterprise target to make money. A 20-person accountancy practice, online retailer, manufacturer or recruitment agency may hold valuable personal data, payment details, client documents and bank account information. Equally, it may depend on a small number of systems: Microsoft 365, a cloud accounting platform, a customer relationship management tool, a phone system and an outsourced IT provider.
That concentration creates a weakness. If one email account is compromised, criminals may impersonate a director, alter bank details on invoices, distribute malicious links internally or access shared files. If a ransomware event encrypts core servers or cloud-synchronised folders, a business with poor recovery arrangements can lose days or weeks of productive work.
Many SMEs also assume that being too small to attract attention is protection. It is not. Automated phishing campaigns, credential-stuffing attacks and exploitation of known software vulnerabilities are designed for scale. They do not require a criminal to research every target individually.
“We have IT support” is not an incident response plan
External IT support is useful, but it is not automatically a full cyber resilience strategy. The business still needs to know who can make decisions during an incident, who contacts customers, who speaks to the bank, whether legal advice is needed and how essential services will continue.
A cyber incident creates decisions outside the technical sphere. For example:
- Should affected systems be disconnected immediately, even if that stops trading?
- Has personal data been accessed, and does the incident need assessing for notification to the Information Commissioner’s Office (ICO)?
- Could fraudulent payment instructions already have reached customers or suppliers?
- Are contractual notifications required under a client agreement?
- Who has authority to engage forensic experts, lawyers or a crisis communications adviser?
Without clear answers, a firm can lose critical hours. The result is often higher recovery costs and greater reputational damage than the original technical compromise alone would have caused.
Controls can exist on paper but fail in practice
Preparedness is not proven by a policy document or an annual staff training slide deck. It is proven when an employee spots a convincing fake supplier email, when multi-factor authentication blocks a stolen password, and when backups can be restored quickly into a clean environment.
Common weaknesses include shared user accounts, former employees retaining access, unrestricted administrator privileges, unpatched remote access software, backups permanently connected to the network and payment changes approved solely by email. Each is manageable, but each requires ownership and routine checking.
What the readiness gap means for cyber insurance
Cyber insurance is sometimes misunderstood as a substitute for cyber security. It is not. A robust policy is designed to finance and coordinate the response to an insured cyber event; it cannot prevent an employee entering credentials into a phishing page or guarantee that a disrupted business can recover without delay.
For a UK SME, the strongest value of cyber insurance may be access to specialist support at the point of crisis. Depending on the policy and circumstances, this may include a breach coach, digital forensics, legal advice, notification support, credit monitoring, crisis communications, data restoration, business interruption cover and cyber extortion response.
However, cover varies substantially. A business should not buy based only on the policy limit or premium. It needs to understand the scenarios that would cause it the most harm.
Key areas to examine before buying or renewing
When comparing cyber insurance for UK SMEs, ask the broker or insurer clear questions about:
- Business interruption: Does cover respond when systems are unavailable due to a cyber incident? How is lost income calculated, and what waiting period applies?
- Dependent business interruption: Could the policy respond if a key cloud provider, managed service provider or software supplier suffers an outage following a cyber event?
- Funds transfer fraud and social engineering: Is fraudulent payment cover included, or is it subject to a separate, lower limit and strict verification conditions?
- Ransomware and extortion: Are investigation, negotiation support, restoration costs and associated legal services covered? What conditions apply?
- Data protection liability: Does the policy cover legal defence, regulatory investigation costs and privacy-related claims where insurable?
- Incident response panel: Which suppliers will respond, and is there a 24/7 emergency helpline?
- Security requirements: What controls must be in place for the policy to respond as expected? Multi-factor authentication, backups and patching are frequent areas of focus.
- Exclusions and aggregation: Are there exclusions relevant to outsourced providers, prior incidents, war-related cyber events or failure to maintain declared security measures?
The proposal form also deserves executive attention. Inaccurate answers about multi-factor authentication, backup procedures or endpoint protection can create serious difficulties later. The person completing it should obtain confirmation from the IT provider rather than relying on assumption.
A practical 90-day cyber resilience plan for SME directors
The preparedness gap can feel daunting, especially where there is no in-house security team. The answer is not to attempt an enterprise-scale programme overnight. Start with controls that reduce the most common and costly routes into the business.
Days 1–30: establish visibility and ownership
Assign a named director or senior manager as accountable for cyber resilience. They do not need to be the technical expert, but they should ensure decisions are made and evidence is maintained.
Create a short inventory of critical systems, key suppliers, privileged accounts and important data. Identify the systems without which the business cannot invoice, fulfil orders, access client work or pay staff. Review who has administrator access and immediately remove dormant accounts.
Also confirm that multi-factor authentication is enforced for email, remote access, finance systems and administrator accounts. Email remains a particularly important starting point because compromised mailboxes often enable fraud and wider attacks.
Days 31–60: improve recovery and payment controls
Test, rather than merely review, backups. A good test asks whether data can be restored, how long it takes and whether the restore point is sufficiently recent. Keep at least one backup copy protected from routine network access or otherwise resistant to ransomware encryption.
Introduce a call-back verification process for changes to supplier bank details and urgent payment requests. Staff should use a known telephone number, not one supplied in the email requesting the change. This simple step can prevent high-value authorised push payment fraud.
Ensure software updates are applied promptly, particularly for internet-facing systems, VPNs, firewalls and remote-management tools. Ask outsourced IT providers for a plain-English report on patching, endpoint protection, monitoring and backup status.
Days 61–90: rehearse the response and align insurance
Produce a one-page incident response playbook with out-of-hours contacts, insurer emergency details, IT provider contacts, bank fraud contacts, decision-makers and immediate containment steps. Then run a 45-minute tabletop exercise around a realistic scenario: a director’s mailbox is compromised and customers receive fraudulent invoices, or files become unavailable after a ransomware alert.
Finally, review cyber insurance against the identified risks and recovery times. If a five-day outage would materially damage the company, a low policy limit or long waiting period may not be appropriate. Conversely, avoid paying for cover that does not reflect the business’s data, dependencies and turnover.
The commercial case: resilience supports growth
Cyber preparedness is increasingly relevant to winning and retaining business. Larger customers, public-sector buyers and regulated clients may ask suppliers about security controls, incident processes and insurance. Demonstrable controls can reduce friction in procurement and provide confidence that a small supplier will not become a weak link in the supply chain.
For directors, this is also a governance issue. The question is no longer whether cyber risk appears on an agenda. It is whether the business can show what it has done about it: who owns the risk, which controls are active, how recovery has been tested and how external support will be mobilised.
The WTW/CFC finding should be read as a prompt to close that distance between concern and capability. SMEs do not need perfect security. They need proportionate defences, tested recovery arrangements, disciplined financial controls and cyber insurance that has been selected with a clear understanding of the firm’s real exposures.
FAQ
Is cyber insurance a legal requirement for UK SMEs?
No, cyber insurance is not generally a legal requirement for UK SMEs. However, some client contracts, supply-chain agreements or professional requirements may ask for it. Even where it is not mandated, it can provide financial and specialist incident-response support following an insured cyber event.
Does cyber insurance cover invoice fraud?
It can, but not always automatically or at the same limit as other cyber losses. Invoice fraud, social engineering and funds transfer fraud may have separate cover sections, lower sub-limits and specific conditions. Check the wording and implement independent verification for changed bank details.
What is the most important cyber control for a small business?
There is no single complete answer, but enforced multi-factor authentication for email and privileged accounts is among the highest-impact starting points. It should be combined with tested backups, timely patching, least-privilege access and staff training on phishing and payment fraud.
Will an IT provider handle a cyber incident for us?
An IT provider may contain and restore systems, but a significant incident can also require forensic investigation, legal advice, regulatory assessment, customer communications and insurer coordination. Confirm in advance exactly what your provider will do, when it is available and what is outside its scope.
Source: Intelligent Insurer — Thu, 22 Oct 2026 13:57:44 GMT
