Cyber Insurance for SMEs: What It Actually Covers, and Why Claims Get Denied

Cyber insurance is often bought the way a fire extinguisher is bought: a box to tick, rarely examined closely, assumed to work when needed. That assumption is riskier than it sounds. In 2026, more cyber insurance claims are being denied than at almost any point in the policy's short history, and the reasons are strikingly consistent: not fraud, not disputed damages, but missing security controls the policyholder had implicitly promised were in place.

For SMEs, understanding this gap matters more than the coverage decision itself. A policy that looks reassuring on paper but doesn't pay out when an incident actually happens isn't protection, it's a false sense of security with a monthly premium attached.

The Coverage Gap Nobody Talks About

Cyber insurance adoption among SMEs remains strikingly low given the actual risk they face.

• Only 10% to 20% of SMEs carry cyber insurance, compared to 60% to 70% adoption among large corporations, an up to eightfold coverage disparity, according to Swiss Re data. Some more recent figures put SME adoption slightly higher at 38% by 2026, still far below the 78% seen among mid-market firms and 92% among enterprises.
• This gap runs directly against the risk profile: 88% of SMB breaches involve ransomware, according to Verizon's 2025 Data Breach Investigations Report, meaning the organizations most exposed to the costliest attack category are also the least likely to have financial protection against it.
• Among SMEs that do purchase a policy, more than 70% carry coverage limits below $1 million, despite the rising cost of downtime and data breaches, leaving many underinsured relative to what a serious incident would actually cost.
• Cost isn't the only barrier: among businesses that choose not to purchase cyber insurance, roughly 45% say they don't see the need, while cost is cited by about 29% and lack of knowledge by 24%, according to industry survey data.

Why So Many Claims Get Denied

The denial statistics are the part of this story SMEs most need to understand before they need to, not after.

• More than 40% of all cyber insurance claims filed are now denied, and in the US specifically, 74% of claims closed in 2024 resulted in no payment at all to the policyholder.
• Insurers have shifted from honor-system questionnaires to something closer to a compliance audit: Marsh McLennan found that 99% of cyber insurance applications now ask specific, evidence-based questions about multi-factor authentication implementation, not just whether it exists, but how comprehensively it's deployed.
• One control dominates the denial data above all others: 82% of denied claims trace back to a single cause, missing or incomplete MFA on critical systems, according to Coalition's claims analysis.
• Over 73% of small businesses now fail their cyber insurance assessments outright, facing either coverage denial or premium increases that can exceed 300%, as insurers tighten underwriting standards in response to rising claim severity.
• Denials aren't limited to missing MFA. Delayed breach notification, gaps in policy exclusion clauses, and insufficient documentation of security controls (incident response plans, employee training records, backup restoration testing) all factor into the roughly 21% of claims that are fully or partially denied specifically due to inadequate controls at the time of the incident.

What Insurers Actually Expect Before They'll Pay

The underlying pattern across these denial statistics is consistent: insurers increasingly expect the same baseline security hygiene that any well-run SME should have in place regardless of insurance, and they verify it rather than take an applicant's word for it.

Multi-factor authentication everywhere it matters. Given that MFA gaps drive the overwhelming majority of denials, this is the single highest-priority control for any SME evaluating or renewing a cyber policy. Partial deployment (protecting email but not remote access, for instance) is increasingly treated the same as no deployment at all.

Tested, verifiable backups. Insurers increasingly ask not just whether backups exist, but whether restoration has actually been tested, directly tying policy eligibility to the same backup discipline that determines whether a ransomware incident even requires a ransom conversation in the first place.

A documented incident response plan. Insurers want to see that a plan exists on paper, with defined roles and a tested process, not simply assumed knowledge held informally by an IT provider.

Employee security awareness training records. Since phishing and credential compromise remain leading entry points for attackers, documented, recurring training has become a standard underwriting expectation rather than a nice-to-have.

Endpoint detection and monitoring. Basic antivirus is increasingly considered insufficient on its own; insurers are looking for more active detection and response capability on company devices.

Understanding What a Policy Actually Covers

Cyber insurance policies vary considerably, but most cover some combination of the following, and it's worth an SME confirming exactly which apply before assuming broad protection:

• Incident response costs: forensic investigation, legal counsel, and crisis communication support in the immediate aftermath.
• Business interruption: lost income and extra expenses incurred while systems are down or operations are degraded.
• Ransom payments and negotiation support: where legally permissible, and often subject to specific conditions and limits.
• Data breach notification and regulatory costs: the costs of notifying affected individuals and regulators, including potential fines where insurable.
• Third-party liability: claims from clients or partners whose data was compromised as a result of the incident.

Exclusion clauses deserve particular attention. War and nation-state attribution exclusions, for instance, are increasingly invoked in denial cases as attackers' links to state actors become easier to establish, a clause many SMEs are unaware exists in their policy until it's tested.

The Financial Case, When a Policy Does Pay

Despite the denial statistics, cyber insurance delivers a genuinely strong return for businesses that experience a claim and had the right controls in place: Howden's 2025 analysis estimated a 19% ROI on cyber insurance among businesses that filed a claim, and organizations using continuous monitoring services saw dramatically lower median claim values than those relying on basic endpoint protection alone, an order-of-magnitude difference in some comparisons.

The pattern across all of this data points to the same conclusion: cyber insurance works best not as a substitute for good security practice, but as a financial backstop for an SME that already has solid fundamentals in place. Buying a policy without the underlying controls is, increasingly, buying a policy that won't pay when it's needed most.

A Practical Checklist Before You Buy or Renew

1. Confirm MFA is deployed comprehensively, not just on the most obvious systems, since this single gap drives the majority of denials.
2. Document your incident response plan, even a simple one, since insurers increasingly ask to see it, not just hear that it exists.
3. Test your backup restoration process and keep a record that you did, since untested backups are both an operational risk and an underwriting red flag.
4. Read the exclusion clauses carefully, particularly around nation-state attribution and specific attack types, before assuming broad coverage.
5. Match coverage limits to realistic exposure, since a majority of SMEs currently carry limits well below what a serious incident would actually cost.
6. Reassess annually, since underwriting requirements are tightening quickly year over year, and a policy that was sufficient last year may already fall short of current expectations.

Insurance Is a Backstop, Not a Substitute for Security

The organizations getting genuine value from cyber insurance in 2026 are the ones treating the underwriting requirements as a useful external checklist for good security practice, not an obstacle to work around. MFA, tested backups, a documented response plan, and basic monitoring aren't just what gets a claim paid, they're the same fundamentals that reduce the odds of needing to file one in the first place.

Meet insurer requirements with confidence with Gladiatek. Bakbit Save keeps your backups immutable and genuinely tested, directly addressing one of the underwriting criteria insurers scrutinize most closely before a claim gets paid. Talk to our team about assessing your current security posture against cyber insurance requirements.

‍