Cheaper Cyber Cover Has Not Closed the SME Protection Gap

For office-based SMEs, the development is important because cyber risk now sits alongside more familiar business interruption, liability and property concerns. A professional services firm, consultancy, accounting office, marketing agency or allied office-based business may not see itself as a technology company, yet it may still depend heavily on email, cloud files, payment systems, client records and remote access. When those systems are interrupted, the commercial impact can move quickly from IT inconvenience to missed deadlines, recovery costs, client communication problems and potential privacy obligations.

The inquiry heard different indicators of the same problem. QBE estimated that about one in five Australian SMEs has cyber insurance, compared with much higher levels among larger organisations. Marsh pointed to recent price falls across cyber markets, while the Insurance Council of Australia highlighted low policy volumes in broader general insurance data. Those figures should not be read as a simple instruction that every business needs the same cover, but they do suggest that affordability and awareness are no longer the only barriers.

The latest Australian Signals Directorate cyber threat reporting adds context. For 2025-26, ASD’s Australian Cyber Security Centre recorded more than 82,000 cybercrime reports, averaging one report every six minutes, and put the average self-reported cost for small business cybercrime reports at about $55,400. Those numbers do not capture every incident, but they show why cyber resilience has become a boardroom and owner-manager issue, not just a technical one.

For a practical office insurance review, businesses may wish to consider:

• whether existing policies clearly address cyber incidents, social engineering, data breaches and system downtime;
• how cyber cover interacts with business interruption, professional indemnity and management liability policies;
• whether sub-limits, waiting periods, exclusions and security conditions match the way the business actually operates;
• what incident response support is available if an attack occurs outside normal business hours;
• whether staff training, multi-factor authentication, backups and supplier controls are being documented.

The key message is not that falling premiums automatically solve the issue. Lower pricing can create a timely opportunity to reassess exposure, but policy wording and risk controls still matter. Businesses seeking general background can review cyber insurance considerations and use tools such as the Cyber Insurance Calculator to frame potential exposure before discussing options with an insurer, adviser or broker.