Hiscox finds UK small firms unclear on cyber cover

Hiscox has reported that 63% of UK small businesses cannot correctly identify what cyber insurance covers. Its survey also found that 55% may be missing at least one core type of business insurance.

The findings came from a survey of 1,000 UK small business owners and formed part of a wider study of 6,250 businesses across six countries. Applying the 55% figure to official business population data for firms with one to 49 employees, Hiscox estimated that 754,000 UK small businesses could face an insurance protection gap.

The research also pointed to confusion beyond cyber cover. Nearly three-quarters, or 74%, of UK small businesses could not correctly identify what professional indemnity insurance covers.

Professional indemnity insurance can protect a business if a client alleges errors or omissions in its work, while cyber insurance is intended to help with incidents such as phishing attacks, ransomware attempts and data breaches. The figures suggest many owners may not fully understand policies designed to cover those risks.

Hiscox also found signs that some businesses are not reviewing their cover regularly. One in seven, or 13%, of UK businesses with property insurance said they last updated their cover three or more years ago, while one in 10, or 10%, said the same of their professional indemnity insurance.

Among businesses employing five to 50 people, the figures were higher. Some 19% said they had last updated their property insurance three or more years ago, and 14% said the same for professional indemnity cover.

Areas of risk

Underinsurance or a lack of insurance could leave small firms exposed to legal claims, property damage, and the operational and financial effects of cyber incidents. Hiscox highlighted public liability, professional indemnity, property insurance, and employers' liability as core areas where cover may be absent.

The survey comes as many smaller companies continue to change how they operate through online payments, cloud systems, and the storage of larger volumes of customer data. Those shifts can alter a firm's exposure to cyber and data risks, particularly if insurance details have not been updated to reflect them.

For employers, the regulatory stakes can be direct. Businesses taking on employees for the first time will usually need employers' liability insurance with cover of at least GBP £5 million from an authorised insurer, and fines can reach GBP £2,500 for every day a business is not properly insured.

Triggers for review

Hiscox set out six changes that should prompt owners to revisit their insurance arrangements: growth in revenue or operations; changes to workforce or working patterns; new services or clients; a bigger role for AI and other technology; new laws or industry rules; and changes to premises, stock, or equipment.

The insurer said businesses should review cover annually, or sooner if revenue, headcount, or operations grow by 20%. It also pointed to cyber incidents and near misses as moments to reassess security controls, incident-response plans, and the information previously supplied to insurers.

Nick Thornhill, Director of Direct and Partnerships at Hiscox UK, said owners often focused on other priorities.

He said: "Running a small business means juggling lots of priorities, and insurance can easily slip down the list. But if something goes wrong, the right cover can make a real difference.

"An uninsured or underinsured incident could leave a small business facing costs it may struggle to absorb, from legal claims and property damage to the financial and operational impact of a cyber incident. For a small business, unexpected costs can affect day-to-day operations, growth plans, or new opportunities.

"As a business evolves and grows, it is worth checking that its insurance still reflects how it operates. That way, if something unexpected happens, the business is less likely to face costs or risks it had not accounted for."

On the timing of policy reviews, Thornhill added: "Updating your business insurance can be easy to put to one side when there are so many other things to think about. But as a business grows and changes, a policy arranged a few years ago may not reflect how it operates today.

"Taking on new staff, offering new services, or relying more on technology can all be good moments to take another look and make any updates."