Seven in 10 Australian SMEs have suffered a cyber incident in the past three years and a similar proportion believe artificial intelligence will significantly increase exposure, according to new research from CFC.

Yet cyber policy take-up remains stubbornly low, with the specialist insurer estimating only 10%-15% of local SMEs purchase standalone cover.

CFC head of global cyber development Lindsey Maher tells insuranceNEWS.com.au Australian SMEs are suffering more cyberattacks than their international peers.

The 70% figure is “disproportionately higher” than the US, Canada and the UK, where the result is closer to 50%-55%. And attacks are expected to increase in frequency as AI’s impact is felt.

Ms Maher says AI isn’t changing the outcome. “It’s still ransomware attacks, social engineering, theft of funds and privacy events.”

But it is accelerating and scaling attacks, and lowering the barrier to entry.

And in Australia, with SMEs making up 98% of the economy, businesses are often vulnerable to attacks that exploit human behaviour.

Ms Maher says human error remains a factor in about 75% of incidents, but 72% of CFC’s survey respondents do not realise cyber insurance covers such circumstances.

“We tend to get so caught up with talking about cyber war and quantum computing and AI that sometimes we forget that [clients] don’t even understand cyber covers things like human error or dependent business interruption and supply chain events.

“So there’s an education opportunity there.”

Clarifying AI coverage

The survey findings come amid debate about whether policies should explicitly cover AI-related risks, or whether exclusions are required to manage emerging exposures.

Earlier this month, CFC updated cyber wording to include explicit affirmative AI coverage, despite already covering many AI-related losses under its policy language.

Ms Maher argues the market should focus on providing certainty rather than creating new exclusions.

“To me, it’s akin to 25 years ago when the internet was being widely adopted by businesses, and people were talking about adding Y2K exclusions and internet exclusions to policies.

“It’s something that was already covered. It’s the reality of how businesses operate today. You can’t exclude what is one of the biggest business risks to clients, because we need to prove that insurance works.

“It’s not in our DNA for there to be any gaps, or clients wondering what our intent is.”

That concern remains particularly relevant for SMEs, many of which still question the value of cyber cover. To address those doubts, CFC has begun highlighting its cyber claims acceptance rate of 99.4% over the past 12 months.

“Not many people share a statistic like that,” Ms Maher said. “But for our brokers, that statistic is incredibly powerful for them to go to clients with and say the product does work. And I don’t doubt most of the Australian and global cyber market have a very similar statistic.”

The human cost

While financial losses typically dominate cyber discussions, CFC says the psychological impacts are hard to ignore.

One of the most significant additions to the insurer’s latest cyber product is executive protection coverage, which includes trauma counselling services for affected executives and key decision-makers.

According to Ms Maher, cyberattacks frequently leave business owners and leaders facing intense personal stress. In ransomware incidents, victims can endure weeks of pressure from threat actors, public scrutiny, board questioning and fears for employees whose jobs may be at risk.

“[CFC staff] are often dealing with clients on the worst day of their lives,” she said.

The new executive protection package also includes cover for theft of personal funds, and temporary relocation expenses when threat actors obtain sensitive personal information and issue direct threats against people or their families.

Those threats have become increasingly sophisticated as criminals exploit publicly available information from sources such as LinkedIn and corporate websites to build detailed profiles of their targets.

“There is a human element and impact that I don’t believe is talked about enough,” Ms Maher said.