Persistent myths about cyber threats could be holding back small businesses

Enduring myths about their cyber exposures could be holding back small businesses from getting the protection they need, a recent survey by Travelers revealed.

In its 2024 Travelers Risk Index, cyber threats were named the top concern among businesses of all sizes.

Hart Research, which conducted the national online survey on behalf of the insurer, polled 1,202 US business decision-makers. This year marked the fourth time in six years that cyber threats have ranked as the primary concern, with a record 62% of participants expressing significant worry about them.

The research also revealed a troubling statistic: nearly half (48%) of smaller businesses don’t think they’ll be a victim of a cyberattack because they aren’t big or complex enough.

Tim Francis, enterprise cyber lead at Travelers, highlighted the misconception in a recent webinar presenting their findings. “(Our data) does show that, oftentimes, the threat actors are simply going after the low-hanging fruit,” he said.

Cyber risks growing for all businesses regardless of size

Francis explained that cybercriminals often target network vulnerabilities rather than specific companies, meaning that businesses with unaddressed weaknesses are at risk of being attacked repeatedly.

“They use scanning technology to find vulnerabilities, deploy malware or social engineering tactics, and sometimes don’t even know who the victim is until they’re inside the network,” he said.

“Once inside, they’ll take money from a small, medium, or large company – size doesn’t matter. If you’ve been attacked and haven’t taken steps to prevent another one, you should expect to get hit again.”

Travelers found a slight rise in reported cyber incidents in this year’s survey, with 24% of respondents saying their company experienced a cyber event, compared to 23% in 2023. More than half of those incidents occurred within the last year and more than 80% within the last two years.

Francis noted the data reflects the growing sophistication and frequency of cyberattacks. “Threat actors that are committing these acts aren’t likely to stop anytime soon,” he said.

Businesses named their top cyber-related concerns as follows:

• Security breach and unauthorized access to financial accounts or control systems (57% each, tied for first)
• Ransomware (54%), which saw the largest increase, rising from the ninth concern in 2023
• Employees putting information or systems at risk through unsafe computing practices (53%)
• System glitches (53%)

Cyber insurance “more than a financial guarantee”

Amid growing challenges in cybersecurity, particularly with the advent of artificial intelligence (AI)-driven cyberattacks, brokers have a strong opportunity to help small businesses get the right protection through an insurance policy.

According to the Travelers Risk Index, 65% of all respondents reported having a cyber policy, up from 60% last year and significantly higher than in 2018, when only 39% had coverage.

However, among small businesses (defined as having 1 to 49 employees), only 41% reported having a cyber policy, compared to 77% and 78% of mid-sized and large companies respectively.

Francis emphasized the importance of cyber insurance as not just a financial safety net but also a critical resource for businesses to access expertise during a cyber event. Small businesses are especially vulnerable because they often lack the resources and knowledge necessary to protect themselves.

“A cyber insurance policy is more than just words on a page and a financial guarantee – it’s an ecosystem of claims professionals,” said Francis. “When a cyber event happens, the insurer often acts as the first responder, bringing in breach coaches and incident response vendors.

“If more businesses understood the magnitude of the events and the level of expertise they’d have access to, I believe we’d see a higher adoption rate. I expect it to rise over time, but it really should be higher already.”

What do you think about the findings in this year’s Travelers Risk Index and the cyber risks that small businesses face? Please share your comments below.