Ask your SME clients what keeps them up at night and, for the first time, the answer is the one you have been giving them. Nearly one in two now rank cyberattacks and data breaches as their biggest business risk — ahead of property damage, losing staff and professional errors. That is the headline of The Cyber Insurance Disconnect, CFC’s first global SME study, covering businesses with revenues below $25 million. Nearly three in five had already lived through a cyber event in three years.
So the awareness sale is made. What has not landed is the detail — where their mental model of the risk is wrong in a specific, expensive direction. They have ranked the risk first and misunderstood both how it will arrive and what their policy pays for when it does.
What do your clients think the threat looks like?
Put the study’s perception numbers next to CFC’s own claims experience and the misread is plain. Only 30% of SMEs identified phishing and social engineering as a major threat. Only 30% cited ransomware. And just 28% recognised human error as a significant risk.
Now the other column. On CFC’s book, ransomware accounts for 64% of cyber claims costs, and human error contributes to 75% of cyber claims. The threat your clients picture is a sophisticated attacker battering at sophisticated defences. The claims that actually arrive start with a person: the payment instruction that looked right and was not, the link clicked in a busy inbox, the fraudulent request approved by someone simply doing their job.
One caveat, stated plainly: these are CFC’s figures from CFC’s research and CFC’s claims, and CFC sells cyber insurance. That does not make the gap invented. It makes it worth showing clients as one major cyber insurer’s actual loss experience, not as gospel about every book.
What does the policy actually pay for?
The second disconnect is bigger. Most SMEs in the study did not know what the product does: 74% did not realise it covers incidents caused by human error, 68% were unaware it includes proactive cybersecurity protection, 61% did not know it provides incident response support, and 68% did not know it offers legal and regulatory support.
Walk a client through a typical modern SME cyber policy in the order they would actually experience it, and it rarely matches the product they think they are buying:
- Hour one: incident response. A 24/7 response team, forensic investigators and containment support — the service a client uses before anyone knows what the loss is.
- Legal and regulatory support. Breach counsel, notification obligations and regulatory handling, in a situation where the first letters sent matter.
- Recovery and interruption. The cost of restoring systems and data, and the revenue lost while the business could not operate normally.
- Liability. Claims from third parties affected by the incident, whose data or money was caught up in it.
And underneath all of it sits the point 74% miss: the incident does not stop being covered because it began with someone’s mistake. “It pays when we mess up” is the single most surprising and most persuasive fact in the policy.
Have you walked one bad Tuesday through their actual policy?
This is the showing-not-telling move, and the study is built for it. Take the most ordinary scenario in the claims data — not a cinematic hack, but a Tuesday. Your client’s bookkeeper receives a payment instruction that appears to come from a supplier. It is approved and paid. The money is gone before anyone knows it was fraudulent.
Now walk it forward against the wording you placed. Who does the client call at hour one, and is that number in their phone or buried in a policy PDF? By day three, what has the policy paid for — the response team tracing how the instruction got in, counsel handling what must be reported and to whom, establishing whether anything else was touched? Which parts of the loss does the policy respond to, and which land on the client?
A client who has walked that timeline once no longer thinks of cyber cover as a bet on being hacked. They understand it as the team and the chequebook that arrive when their own person makes the most human mistake in business. That is a different renewal conversation.
What is the renewal conversation actually for?
“The cyber insurance disconnect is ultimately an education gap,” said Lindsey Maher, CFC’s head of global cyber development. The industry, she argued, spent a decade building awareness; the next decade has to turn awareness into resilience, with simpler conversations about what the cover actually does.
One more number: 68% of SMEs expect AI to increase their cyber risk over the next two to three years, while adopting AI tools faster than they are adapting their protection. Whether their wording addresses AI-driven attacks is now a legitimate renewal question, not a futuristic one.
None of this means the cover fixes the misread. A policy cannot teach a client where losses actually come from — but the renewal conversation can, and it is the broker’s to lead. The study hands you the claims picture that corrects their model of it, while there is still time to buy against the threat that actually shows up: an ordinary person, an ordinary mistake, and a policy they finally understand.
Sources: Insurance Business US, “SMEs rank cyber their top risk but misread the threats: CFC” (October 22, 2026), reporting CFC, The Cyber Insurance Disconnect — CFC’s first global SME research project; CFC launch release for The Cyber Insurance Disconnect (October 2026). Claims figures are CFC’s own claims experience as reported in the study; coverage elements described are typical of modern SME cyber policies and will vary by wording.