The Australian Cyber Security Centre (ACSC) received over 84,700 cybercrime reports in the 2024-25 financial year, an average of one every six minutes. Yet many Australian SMEs still operate without dedicated cyber insurance coverage, mistakenly believing they're either too small to be a target or that their IT provider's defences are sufficient.
Smaller businesses are targets too
Many attacks are automated and sent to thousands of businesses at once, so being small is no protection, and smaller businesses are often less well defended.
Common attack types facing Australian SMEs include:
- Business Email Compromise (BEC): Fraudulent emails impersonating executives or suppliers that trick staff into transferring funds or sharing credentials
- Ransomware: Malicious software that encrypts your business data and demands payment for its release
- Data breaches: Unauthorised access to customer or employee personally identifiable information (PII)
- Supply chain attacks: Compromise of a third-party vendor's systems to gain access to your business
The ACSC's Annual Cyber Threat Report 2024-25 put the average self-reported cost of cybercrime for an Australian small business at $56,600 per report, up 14% on the year before, and that is the average. A serious ransomware incident involving encrypted systems and a week-long operational shutdown can cost multiples of that figure.
What cyber insurance covers
Standard business insurance policies (property, public liability, professional indemnity) were not designed to respond to cyber incidents. There is typically no coverage for:
- Loss of revenue while your systems are down
- Ransomware demand payments
- Data recovery costs
- Regulatory fines under the Privacy Act
- Notification costs to affected customers
- Reputational management and PR expenses
A dedicated cyber insurance policy fills these gaps. At Ardent, we place cyber policies that typically cover:
First-party losses (costs to your own business)
- Business interruption: Revenue lost while systems are offline
- Data recovery: Cost of restoring or recreating corrupted data
- Ransomware extortion: Payment to attackers where the law and the policy allow it (sanctions and reporting rules apply), plus negotiation assistance
- Crisis management: Forensic investigators, PR advisors, and legal counsel
- Notification costs: Legally required notification to affected individuals under the Privacy Act
Third-party liability (claims against you)
- Privacy liability: Claims from customers or employees whose data was compromised
- Regulatory proceedings: Costs of responding to OAIC investigations, and fines and penalties only where they are insurable by law
- Network security liability: Third-party claims arising from your systems being the source of an attack
Misconceptions we hear from business owners
"Our IT company protects us, so we don't need insurance."
IT security is a risk reduction measure, not a risk transfer mechanism. Even well-secured businesses get breached. Cyber insurance is what happens after your security controls are bypassed.
"We don't store sensitive customer data."
You store more than you think. Employee payroll records, supplier bank account details, email histories, and operational data all have value to criminals, and potential regulatory significance under Australia's Privacy Act.
"We're too small to be a target."
Modern cyberattacks are largely automated and indiscriminate. Criminals scan millions of internet-connected systems at once looking for vulnerabilities. They are not researching your revenue or industry before attacking.
"Cyber insurance is too expensive."
What an SME pays depends on turnover, industry and the controls you have in place. Against an average small business cost of $56,600, and six-figure losses in serious cases, cover is prudent risk management.
What underwriters look for, and how to reduce your premium
Before placing cyber coverage, insurers will assess your cyber hygiene. The measures that have the greatest premium impact are:
- Multi-factor authentication (MFA): Required across all remote access and email systems. Insurers ask about this first, and some will not quote without it
- Endpoint Detection & Response (EDR): Modern antivirus/anti-malware across all endpoints
- Offsite/immutable backups: Regular backups stored separately from your main systems
- Patch management: Timely application of software security updates
- Staff training: Regular phishing simulation and cybersecurity awareness training
Businesses with strong controls in these five areas generally secure better terms and lower premiums. Businesses without them may find coverage difficult to obtain or prohibitively expensive.
How Ardent approaches cyber insurance
Cyber insurance is one of the most rapidly evolving lines of coverage in the market. Policy wording varies significantly between insurers, and the difference between a well-structured policy and a poorly worded one only becomes apparent at claim time.
We go through your systems and how the business runs before going to market. We then benchmark available terms across our insurer panel (which, through the Steadfast network, includes every major cyber insurer operating in Australia) and present you with a clear recommendation that balances protection and cost.
If you'd like to discuss your cyber exposure, or review an existing policy's adequacy, contact our team for a no-obligation conversation.