Last week, representatives from the Insurance Council, QBE and Marsh addressed the parliamentary inquiry into cybersecurity for SMEs, telling MPs insurance is getting cheaper and more accessible but take-up is still low at about 20%.

insuranceNEWS.com.au also spoke recently with specialist cyber insurer CFC, which said SMEs in Australia are suffering more attacks than in similar countries. It also said it paid almost every cyber claim.

What do brokers make of the trends? Insurance News spoke to Abhi Rao, MD of Sydney-based Risk Advisory Hub.

Abhi Rao

Are prices for cyber insurance falling, and how can brokers encourage take-up?

In our own placements, we’re seeing more insurers compete for the same SME cyber business, and that competition is bringing premiums down. At renewal, a competitive quote gives us something concrete to take back to the existing insurer. We can ask them to improve the premium for the same limit and excess. For a business owner who decided cyber was too expensive a few years ago, I’d reopen that conversation with a current quote and walk them through what it would buy.

For a financial services firm (our key clientele), I’d ask: “If someone stole your clients’ identity documents and financial records, who would help you work out what you had to report, to whom and by when? What would you say to a client who rang to ask whether their identity was at risk?” An adviser could lose a relationship built over 20 years. The accountant who referred that client might think twice about the next referral, too. That’s where I’d show the owner what the quoted policy provides for privacy advice, client notifications and crisis communications.

Are insurers making cyber cover easier for SMEs to obtain?

Yes. Some insurers now start with the business’ web domain and scan what’s visible from the public internet. That can flag an exposed remote access service or software with a known vulnerability. Underwriters use those findings alongside the business’ industry, turnover and claims history to decide what premium and terms to offer. For an eligible SME, that can mean getting a quote after answering just a handful of questions. If the insurer needs something fixed before cover starts, we can take a specific finding straight to the client’s IT provider.

Are policyholders reluctant to report incidents for fear of premium increases, as one MP suggested?

I wouldn’t say we have evidence that premium concerns are driving delays. I can understand an owner wanting their IT provider to confirm exactly what’s happened before they call the insurer. My advice is to make both calls straight away. In a ransomware incident, the IT provider may be ready to restore systems while the forensic team needs to preserve evidence of how the attacker got in. Getting them on the same call early helps everyone agree what to do first. The owner can notify the insurer while the investigation is still under way.

Should brokers talk about high cyber claim acceptance rates?

Yes. CFC says it accepted 99.4% of its cyber claims over the 12 months it reported on. I’d use that figure with a client who doubts insurers pay, and I’d make clear it’s CFC’s own result.

We’ve seen ransomware claims first-hand. What I’d want an SME owner to understand is how much an insurer can do before anyone knows the size of the loss. When a ransom demand lands, there are immediate questions. Can staff safely log back in? Has anyone taken client files? What can the owner tell clients who are already on the phone? The insurer’s response team can bring in forensic specialists to work alongside the firm’s IT provider and privacy lawyers to advise on what needs to be reported. For a small business, knowing who can help with those decisions is one of the strongest reasons to buy the cover.

Do brokers need to explain better that cyber cover includes human error and supply chain?

Yes. When we compare cyber quotes, one difference we see is how they treat social engineering fraud. Some policies include it, others offer it as an extension, and the amount available can be well below the main cyber limit. That matters when someone in accounts is tricked into paying a genuine supplier invoice into a fraudster’s account. They might have received what looks like an email from a regular supplier advising for new bank details – they pay it and only discover the scam when the supplier chases payment.

We check the wording and schedule so we can tell the client whether the money they transferred is covered, how much they could recover and whether they need to verify changed bank details by calling the supplier on a known number.

We also look at which suppliers a client relies on to trade. For an online retailer, that might be the platform that takes its orders. An attack on that provider can stop sales even while the retailer’s own systems are working. When we compare dependent business interruption cover, we check whether that provider is covered, how long the outage has to last and what limit applies.

Is AI changing claims, and should policies explicitly cover AI-related risks?

The clearest change we’re seeing is in the policy wording. Some insurers now expressly address deepfakes and cloned voices in their social engineering cover. For example, someone in finance gets a call that sounds like their managing director authorising an urgent transfer. AI makes that impersonation more convincing and easier to repeat across businesses.

From a claims perspective, the money leaving the account is straightforward to document. The loss still presents as payment fraud. Establishing how the caller produced the voice can be much harder, so I’d be cautious about attributing a rise in claims to AI. We favour wording that tells the client whether that payment is covered and what verification steps apply. I’d push back on a blanket AI exclusion because it creates uncertainty around a type of fraud clients already buy cover for.

I’d like policies to be explicit. If a client buys social engineering cover, they should know whether it responds to a transfer induced by a cloned voice, what verification steps are required and what limit applies.

Why might Australian SMEs have reported more cyber incidents than their overseas peers, as CFC says?

I think Australia’s privacy obligations can make firms holding sensitive information attractive targets for extortion. Even if a medical practice can restore every patient file from back-up, a criminal can still threaten to publish the copies they stole. A business covered by the Privacy Act generally has to notify the privacy regulator and the people at risk if it can’t prevent likely serious harm from the breach. The Federal Court ordered Australian Clinical Labs to pay $5.8 million for failures in protecting personal information, assessing a breach and notifying the regulator.

That threat of publication gives criminals leverage, and some businesses do pay. The Department of Home Affairs received 46 ransomware payment reports from businesses with turnover of at least $3 million between May 30 and October 24 2025. Paying doesn’t guarantee the data stays private or remove a duty to notify. I see that pressure as one reason an attacker might choose a particular firm.