Hiscox Report: 63% of UK Small Businesses Fail to Identify Cyber Insurance Coverage

New research from Hiscox reveals a significant knowledge gap among UK small businesses, with 63% unable to define cyber insurance coverage. For brokers and carriers, this highlights a critical protection gap and an urgent need for improved education and distribution strategies as 55% of SMEs currently lack at least one core business insurance policy.

What was announced

The findings, published in Hiscox’s Global Protection Gap Report, are based on a survey of 1,000 UK small business owners. The data suggests a widespread misunderstanding of essential risk mitigation tools; beyond the 63% who could not identify the purpose of cyber insurance, nearly three-quarters (74%) were unable to correctly identify what professional indemnity insurance covers. This lack of clarity is compounded by a failure to maintain up-to-date policies. One in seven (13%) UK businesses with property insurance reported that their cover was last updated three or more years ago. This figure rises to 19% among mid-sized small businesses employing between five and 50 people.

The report identifies several operational shifts that should trigger an insurance review but are often overlooked by business owners. These include:

• Migrating to cloud-based systems
• Introducing online payment processing
• Increasing the volume of stored customer data
• Taking on new staff or offering new services

With phishing attacks, ransomware attempts, and data breaches cited as primary threats, the insurer suggests that small businesses are frequently underinsured against the financial and operational fallout of a digital incident. The research indicates that over half of the UK's small business population is missing at least one type of core business insurance, leaving them exposed to legal claims and property damage costs that they may be unable to absorb. The insurer recommends that owners use cyber incidents and "near misses" as specific opportunities to review existing security controls and incident-response plans.

"Running a small business means juggling lots of priorities, and insurance can easily slip down the priority list. But if something goes wrong, the right cover can make a real difference."

Nick Thornhill, Direct and Partnerships Director at Hiscox UK

The companies involved

Hiscox is a specialist insurance group with a significant presence in the UK and international markets. The firm focuses on niche areas of the insurance industry, providing cover for high-net-worth individuals, professional indemnity, and increasingly complex cyber risks. As a carrier, Hiscox operates across several segments, including retail business in the UK, Europe, and the US, as well as globally traded insurance and reinsurance through Hiscox London Market and Hiscox Re & ILS.

The company is known for its focus on underwriting discipline and its role in the small-to-medium enterprise (SME) sector, where it often acts as both a direct provider and a partner for brokers. By positioning itself as a specialist in "specialist" risks, the group aims to address the specific needs of businesses that fall outside the appetite of generalist insurers. Its digital operations and partnership models, overseen by leadership such as Nick Thornhill, are central to its strategy of reaching smaller commercial entities that require tailored protection against evolving digital and professional liabilities. The group maintains a focus on the "protection gap," identifying where market awareness fails to keep pace with emerging operational risks.

What this means from an insurtech perspective

This data highlights a significant failure in the traditional distribution and communication of insurance products to the SME sector. For insurtech vendors and digital MGAs, the "protection gap" identified here is less about a lack of capacity and more about a lack of engagement and education. The fact that nearly 20% of larger SMEs have not updated property cover in three years suggests that legacy renewal cycles are failing to capture real-time business changes. This creates a clear opening for platforms that use automated data ingestion—such as linking to accounting software or web monitoring—to trigger mid-term adjustments and proactive coverage suggestions.

From an underwriting perspective, these findings are a warning. Carriers and brokers who rely on manual declarations are increasingly at risk of holding portfolios riddled with underinsurance. This inevitably leads to friction during the claims process and a breakdown in customer trust when a "near miss" turns into a total loss that is not covered. The industry must move toward more embedded or "invisible" insurance models that adjust automatically as a business moves to the cloud or begins processing online payments, ensuring that the policy reflects the current risk profile without requiring the business owner to be an insurance expert.