Skip to main content

Computerease

GET A QUOTE

When Insurance Companies Start Warning Small Businesses About Cyberattacks,
Pay Attention

Small business owner reviewing cyber insurance and cybersecurity risks

I recently saw something I’ve been saying for years in a place I wasn’t expecting to see it: at the bottom of an email from my business insurance company.

The email was from Chubb and had to do with our business insurance renewal. At the bottom was information about cyber risk, and two points caught my attention.

Chubb said small businesses are a top target for cybercriminals and are experiencing a higher rate of growth in cyber incidents than businesses overall. It also warned that many cyber-related lawsuits and claims are resolved in millions of dollars.

We talk about cybersecurity every day at Computerease, so naturally you’re going to hear us tell businesses the risk is real. But when I saw an insurance company saying it, I paid attention because they see a different side of the problem.

Insurance companies see what happens after an attack. They see the claims, lawsuits, recovery expenses, business interruption, and financial damage, and they have the data to understand what these incidents are costing businesses. That’s what made a few lines at the bottom of an otherwise routine insurance email worth talking about.

Small Businesses Really Are Being Targeted

For years, we’ve heard business owners say some version of, “Why would a hacker come after us? We’re too small.”

Cybercriminals aren’t only looking for the biggest possible company. They’re looking for opportunities, and smaller businesses can have valuable information and money moving through their systems without the security resources of a much larger organization.

An accounting firm, manufacturer, medical practice, or professional services company with 5 to 50 employees still has bank accounts, customer information, employee records, Microsoft 365 accounts, vendor relationships, and access to other organizations. A criminal doesn’t need to attack a Fortune 500 company if compromising a smaller business gives them an opportunity to steal money or information.

That’s what made Chubb’s statement about small businesses being a top target stand out to me. This doesn’t come from a cybersecurity company. It comes from an insurance company that deals with the financial consequences when those attacks succeed.

Insurance Companies See What Happens Next

The attack itself may be only the beginning of the expense.

If systems are unavailable for several days, employees may not be able to work normally while customers still expect service. Payroll and operating expenses continue even if the business is losing revenue because systems are down.

If customer or employee information was exposed, someone must determine what happened and what information was affected. Attorneys may become involved, customers may need to be notified, forensic specialists may need to investigate, and systems may need to be restored.

There are also costs that are harder to calculate. Customers may have questions about whether their information is safe, larger clients may want to know what security changes are being made, and employees may spend days or weeks dealing with the aftermath instead of doing their normal work.

When you consider everything that can follow an attack, Chubb’s warning about lawsuits and claims reaching millions of dollars makes a lot more sense.

Cyber Insurance Helps Pay the Bill. It Can’t Undo the Damage.

None of this is an argument against cyber insurance. I strongly believe businesses should carry appropriate coverage, and we’ve seen how valuable it can be when something goes wrong.

Insurance can provide financial protection and access to legal resources, forensic specialists, incident-response professionals, and other resources when a business needs them most. Depending on the policy and circumstances, it may also help with lost income, recovery expenses, and other costs related to an incident.

Insurance and cybersecurity have different jobs. Cyber insurance helps deal with the financial consequences after an incident, while good cybersecurity is intended to reduce the chances of getting to that point and limit the damage if someone does get through. And good cybersecurity is a prerequisite for cyber insurance coverage.

Even when insurance helps cover the expense, it can’t give you back the week your employees couldn’t work normally, undo the conversation with a customer whose information was exposed, or eliminate the disruption while your business recovers. That’s why businesses need both.

Pay Attention Before You’re Filing the Claim

What struck me most about that Chubb email wasn’t reading that cyberattacks are expensive. It was seeing an insurance company put the same warning we’ve been giving businesses for years right there in routine communication with its customers.

They’re seeing what happens after these incidents, and they’re seeing what the claims cost.

Review Your Cyber Risk Before It Becomes a Claim

If you’re not sure how prepared your business would be if an attacker targeted you tomorrow, schedule a 30-minute Cyber Risk Review with us

We’ll look at where your biggest risks may be today and help you understand what can be addressed before you’re dealing with the aftermath of an attack and call your insurance company to file a claim.