With cyberattacks rife and rising all the time, cybersecurity is essential, but so too is cyber insurance. Although many businesses have been slow to adopt such cover, the world is beginning to wake up to the substantial benefits of cyber insurance for safeguarding an organisation. Here we look at the significant advantages it offers.

Why choose cyber insurance?

Businesses are increasingly at risk of falling foul of cyber-related incidents. Recent data shows that global cyberattacks increased by 38% in 2022, compared to 2021.  And the UK saw a massive 77% rise. The fact is, cybersecurity is never 100% effective.

Should the worst happen, having cyber insurance could be the difference in ensuring your business gets up and running again quickly. Some 60% of small businesses close within six months of suffering a cyberattack. So having some sort of back-up plan is crucial.

But why do you specifically need cyber insurance, rather than just standard business insurance? Well, cyber insurance is a specialist product that protects you from cyber risks and those related to IT infrastructure. The fundamental benefit of cyber insurance is that it covers risks that aren’t generally included in standard commercial liability policies, which tend to just cover costs related to technical issues, such as corrupted hard drives and lost devices.

Managing a cyber incident, such as a data breach or ransomware attack, requires detailed technical knowledge, which specialist cyber insurance can offer. Cyber insurance policies provide you with the means to implement incident response measures, such as legal assistance, public relations support and forensic investigation. 

As well as minimising any business disruption and supplying financial protection during an incident, a big benefit of cyber insurance is that it could help with any legal and regulatory actions after an incident. Although it won’t solve all your cybersecurity challenges or prevent a cyberattack from happening, cyber insurance can help your organisation get back on its feet.

Want to protect your business but unsure where to start? Check out our free guide to cyber insurance.

What could your cyber insurance cover?

As with other types of insurance, the benefits your cyber insurance includes will depend on the cover you choose. Opting for first-party cover will protect you against the direct results of a cyberattack. Alternatively, third-party cover is more comprehensive and will include the indirect consequences of a cyberattack. This provides protection for managed service providers (MSPs) that supply professional services to other companies. It’s key to covering your liability should a cyberattack on you lead to losses from a partner or customer.

Online threats are multiplying all the time, and cyber insurance will cover you for a wide variety of these risks, such as data privacy breaches, phishing attacks, distributed denial of service (DDoS) attacks, and malware, including the dreaded ransomware attack. 

Depending on the exact policy you choose, it should cover:

• Loss of business income 
• Legal action and fines, like GDPR charges
• Ransom costs, if your data is held hostage
• PR support to regain damaged trust
• Possible repair costs 
• Data breach measures, such as investigative proceedings

Access to expert advice and support

A key benefit of cyber insurance is that it gives you access to expert advice and support. Expertise on threat management is an important part of cyber insurance, and some insurers supply businesses with threat monitoring and management services. For example, according to the UK government’s Cyber Security Breaches Survey 2022, one organisation said that their insurance enabled them to monitor the dark web and flag if any of their accounts were being sold there.

Access to expertise on breach recovery was also named in the survey as a key reason organisations take out an insurance policy. This benefit can help companies ensure business continuity after a disruptive breach. Some policies also include access to expert forensic analysis of what caused the breach. This is important to help a business rectify the problem and implement preventative measures to make sure it doesn’t happen again.

Enhanced cybersecurity

Another valuable benefit is that a cyber insurance policy can help you build a strong cybersecurity framework. Insurers will require you to have a good level of security to be eligible for a policy. They usually carry out a risk assessment as part of the underwriting process to ensure your business isn’t a high risk. This can involve just completing a straightforward questionnaire or may go as far as involving an in-depth analysis of your security. However, like other kinds of insurance, your premium will decrease if you are judged to be a lower risk.

The eligibility criteria for cyber insurance cover can act as a framework to ensure good cyber hygiene. But, a simple way to boost your level of cybersecurity is to gain Cyber Essentials certification. Some insurers will offer discounts on insurance premiums if you have this, and simply by being certified, you can reduce your cyber risk by 98.5%. Cyber Essentials is a UK government-backed scheme covering everything your business should do to protect against cyberattacks, demonstrating that you take cybersecurity seriously.

Peace of mind

A big benefit of cyber insurance, which shouldn’t be overlooked, is that it provides considerable peace of mind. You can have all the strong cybersecurity possible to protect your business. However, with the ever-evolving threat landscape, you can’t be 100% sure you won’t still suffer from a cyberattack. With cyber insurance, you have the final safety net in place to ensure that you won’t have to worry about recovery costs if the worst happens and disaster strikes.

While cyber insurance doesn’t prevent an attack, it’s designed to stop a bad situation from getting worse. So, if you’re concerned about a cyberattack destroying your business, cyber insurance gives you complete peace of mind. You will have an extra layer of protection in addition to your cybersecurity, to cushion the blow.

Ideally, no business only does the bare minimum for their cybersecurity. But it’s understandable that many small or medium businesses are limited by their budget. If this is the case for yours, you need basic cybersecurity measures that are effective yet affordable.

Here’s how you can ensure your business is protected and secure, without breaking the bank.

5 basic cybersecurity measures for businesses

Cybersecurity mustn’t slip under the radar for small businesses. 43% of all data breaches involve small businesses, with 60% of these businesses filing for bankruptcy within six months of an attack. 

Luckily, the cybersecurity landscape is full of many great solutions to secure your business, ranging in complexity and price depending on the levels of protection you need. And it can be helpful to go back to basics in tough economic times.

You can do this without sacrificing security by following the control areas of Cyber Essentials. We’ve outlined them, and what they mean for small businesses, in this blog.

Here are some examples of the basic cybersecurity measures that any small business can take to maintain a good level of protection against cyber threats:

1. Make your business internet connection secure

There’s always a risk to your business network and equipment when you have a broadband connection. Think about it – it’s always on – so there’s always a window of opportunity.

Luckily there’s no need to fret. Instead, ensure that you’re using a business broadband package. They’re more comprehensive compared to a home broadband package and include proactive security measures.

For example, many business broadband options are equipped with higher-grade security software. You should look for features such as a VPN, firewall, and the ability to filter content. With this functionality, you don’t need to spend more on additional solutions because your key security features are built in.

Need help finding the right cybersecurity accreditation for your business? Check out our guide.

2. Switch on secure settings for business devices

Business equipment and software often come with the manufacturer’s default settings. This is useful to set things up quickly. But did you know that it’s easy to ‘upgrade’ your devices to a more secure setting?

Secure settings provide a greater level of protection against security vulnerabilities. Simply check the settings of your business equipment and take a critical look at its features and services. For more explicit advice, the National Cyber Security Centre provides free, trusted security guidance for businesses across a wide range of platforms.

You can also implement measures like multi-factor authentication across devices as an additional level of security. Or set up a locking mechanism across devices that require either biometric, password or PIN access.

3. Manage data access in your business

Check that only the right people have access to the data they need in your business. 

For example, only certain team members might need to access sensitive data, so they are the only ones that need permission. 

A ‘least privilege’ policy is the best method of managing data access in your business. It only allows users to have the minimum level of access or permissions needed to perform their jobs. This creates a safer environment for your data and reduces the risk of harmful, or accidental, actions. 

4. Protect against malware and viruses

Antivirus software is a basic cybersecurity measure for all businesses. It’s a type of software product that detects, quarantines, and blocks malware from running on your business devices. These are malicious programs that can impact your data, alter, or hijack functions, or monitor end-user activity.

If your budget is tight, you don’t necessarily have to spend a lot of money on antivirus software. There are free and built-in anti-virus solutions for most popular business platforms. If you’re looking for something a little more robust, read our blog that highlights our top 10 antivirus products.

5. Keep software and devices up to date

Manufacturers release regular updates for software and equipment like new features or bug fixes.

The programs, software, devices, systems, and tools you use every day will require updating every now and then. And if you’re using an old version of them that isn’t up-to-date, it leaves your business open to vulnerabilities. Ironically, even outdated antivirus software could be exploited by bad actors.

Regularly patching your software and devices avoids these problems. Making sure every tool in your business is running the latest version helps you create a safer working environment. 

Always cover the basic cybersecurity principles

Implementing these basic cybersecurity measures is a simple, straightforward, and affordable method of keeping your business secure. 

And for small or medium businesses looking for extra security qualifications, these steps are part and parcel of qualifying for a Cyber Essentials certification – a government-backed qualification that proves to customers and partners that your business protects itself from cyberattacks.

Still unsure about what the 'must haves' are when it comes to your business's cybersecurity? Then check out our guide to cybersecurity on a budget.

The economy has taken a battering in recent times, and there’s much talk about the so-called ‘cost-of-living crisis’ we’re now experiencing. Whether there’s a full-blown recession ahead, or not, it looks like the economic outlook won’t improve any time soon. And experts agree this will spark a surge in cyberattacks. So, let’s take a look at why cybercrime increases with the looming threat of recession.

Why we can expect cybercrime to increase

The word among industry analysts is that the ongoing economic downturn will result in a significant rise in cyberattacks. Cybercriminals are already exploiting the financial situation, with an increase in social engineering attacks such as phishing emails offering rebates on energy bills to target vulnerable individuals and businesses. And, by all accounts, we can expect a great deal more of the same to come, as a distinct correlation exists between an uptick in cyberattacks and economic uncertainty.

Data shows that some types of cyberattacks are already rising considerably. According to Kaspersky Lab, the percentage of users affected by targeted ransomware doubled in the first 10 months of 2022. Phishing attacks also increased by 61% in 2022, according to the 2022 State of Phishing report from SlashNext. And, the Anti-Phishing Working Group (APWG) reported that there were a total of three million phishing attacks in the third quarter of the year – amounting to the worst quarter it had ever seen. 

Considering cyber insurance for your business? Check out our new guide for everything you need to know.

What role do businesses play? 

There are many reasons why cybercrime is increasing amid the current economic uncertainty. But most importantly, businesses are having to make difficult decisions to rein in costs. This is completely understandable in the climate. After all, we're all trying to keep our heads above water, but this could have a direct effect on businesses' online safety.

Although it’s ill-advised to reduce cybersecurity budgets, many business leaders underestimate the value of cybersecurity. The situation isn't helped by the perceptions of cybersecurity within organisations. IT leaders can often find it difficult to justify spending on cybersecurity, which doesn't often deliver visible benefits in the way other OPEX spending does. Think about it; you're unlikely to hear much about your business's cybersecurity unless something goes wrong. 

The result is often cuts in places they shouldn't happen. Consequently, such companies are at higher risk of falling foul of cyberattacks.

Businesses may also decide to cut spending by letting staff go or not replacing those that leave. And this can also impact a company’s resilience to cybercrime. Cutting IT staff may mean you have fewer people to provide the necessary protection. 

This also increases the pressure on your remaining staff which can lead to mistakes and oversights, which weaken your defences further. For example, if they receive a phishing email they’re more likely to make an error of judgement and click on a link that could download malware into your network.

Cybercriminals aren’t immune to economic instability

If you’re still wondering why cybercrime is increasing, well, a recession hits cybercriminals as well as their victims. So, this can be a strong motivating factor for the bad guys to redouble their efforts and make more money. The hard fact is that a recession, or economic downturn, incentivises cybercriminals to invent new types of threats. This was demonstrated during the recession of 2008 when the FBI reported a 22.3% increase in online crime. 

More recently, a crisis of a different sort, the pandemic, sparked a similar surge in cybercrime. And there’s no reason to think the current hardships won’t create a similar spike. Companies will continue to lay off employees in the months ahead, and some may be tempted into cybercrime to make ends meet. Disgruntled employees who’ve been fired could also launch damaging attacks on businesses that have let them go, especially if they still have access to sensitive data.

Another repercussion of the recession is a possible rise in insider attacks from employees who are feeling the pinch. This is particularly likely in businesses that have been forced to freeze salaries. Cybercriminals can specifically target possible insiders to help with data breaches or cyberattacks, using social media and offering bribes. 

Fighting back on a budget

Cybersecurity isn’t a nice to have, it’s business critical. And this is never truer than in times of economic crisis. 

Small and medium-sized businesses often underestimate the danger they're in. In part, due to the perception that only large corporates are targets. However, the truth is that cybercriminals don’t discriminate and the effects can be devastating. In fact, research has found that 43% of all data breaches involve small businesses.

However, you don’t need expensive tools, expert consultants, or an in-house technical team, to protect your business from cyber threats. It’s perfectly possible to build good defences on a sensible budget. Tools like CyberSmart Active Protect offer everything you need to get your cybersecurity in order, without huge investment. 

Active Protect provides secures all employee devices that touch your company data. Just send a downloadable link to staff, and Active Protect will check around the clock for the most common cyber threats and vulnerabilities It also includes our training academy, which provides your employees with the basic cyber skills to better protect themselves and your business. 

Want to know more? Then check out our guide to cybersecurity on a budget.

If you’re wondering ‘Is cybersecurity really worth it?’ The short answer to this question is unequivocally, ‘Yes!’. Especially now that the economic climate is taking a downturn. In this cost-of-living crisis, the threat to your business from rising cybercrime rates could be even higher. But let’s see why cybersecurity is worth spending some money on compared to the cost of cybercrime.

False economy

Rising costs for just about everything means businesses have to make cutbacks. The trick to riding out the storm is recognising what’s an essential and what’s a luxury to cut. Cybersecurity falls into the ‘essential’ category. 

Cybersecurity should be thought of as an investment, not an expense. It protects you from the much greater costs of cybercrime. For example, business disruption and financial losses. In fact, all you can do to protect yourself in preparation for a possible attack will save you money in future. Cutting back on such a necessity would only be a false economy.

If you run a small business, you could be forgiven for thinking that cybersecurity isn’t worth it. You may conclude that your business isn’t at risk if you’ve seen the media coverage of cyberattacks on large corporations. Unfortunately, this isn't true. No business is too large or too small to be subjected to cybercrime. Research suggests that 43% of all data breaches involve small businesses. In fact, smaller businesses can be an attractive target as they may be less likely to have the necessary cybersecurity to keep their data safe.

Strong cybersecurity is always worth it. Beyond the immediate financial cost of cybercrime, which can be high, the damage to your business’s reputation if confidential data is exposed can be long-lasting. This may affect your ability to do business in future, especially if you’re in a sector that handles highly sensitive data, such as financial services and healthcare. Potential customers will think twice before handing over personal and financial details if they doubt that they’ll be protected.

The true cost of cybercrime to a business can be complex and far-reaching and may include:

• Significant monetary theft
• Substantial business downtime
• Damage to your business’s reputation
• An increase in your insurance premiums
• Loss of intellectual property
• Network repairs
• Public relation costs
• Compliance fines

Confused about Cyber Insurance? Check out our new guide for everything you need to know.

A good return on investment

Good cybersecurity delivers a good return on investment (ROI) by preventing or mitigating the impact of an attack. According to the UK Government’s Cyber Security Cyber Breaches Survey 2022, in the last 12 months, 39% of UK businesses identified a cyberattack. And, in the case of those organisations that reported a material outcome, such as loss of money or data, there was an average estimated cost of £4,200. However, where only medium and large businesses were considered, this figure rose to £19,400. Far worse, according to a study by TrendMicro, 60% of small businesses close within six months of a cyberattack. 

What’s more, another survey found that 83% of small and medium-sized businesses aren’t financially prepared to recover from a cyberattack. Indeed, a report by the European Union Agency for Cybersecurity (ENISA) revealed that 85% of surveyed small and medium-sized enterprises agreed that cybersecurity issues would seriously affect their businesses, and 57% admitted they would most likely go out of business.

Even if your company survives such an attack, the cost of cybercrime can be devastating. A study by Cisco found that 40% of small businesses that are hit by a severe cyberattack experienced at least eight hours of downtime, accounting for a large part of the overall cost of a security breach. 

So, a relatively small investment in cybersecurity today gives you a good ROI by saving you money in the long run.

The rising rate of cybercrime

The chances of being the victim of cybercrime are also growing fast, so the time is right to get your house in order and protect your business with reliable cybersecurity. 

Rates of cybercrime have been increasing for years, with a rapid rise in remote and hybrid working heightening companies’ vulnerability to attack. But over the last year, attacks have spiked. For example, the percentage of users impacted by targeted ransomware doubled in the first 10 months of 2022. And, according to the 2022 State of Phishing report from SlashNext, phishing attacks have also increased by 61% in 2022.

Experts warn that with the cost-of-living crisis, we should expect cybercrime to escalate even more and cyberattacks to increase in sophistication. Unfortunately, there is a correlation between tough economic times and a rise in cyberattacks. More people may be tempted to turn to cybercrime, and there could be an increase in social engineering attacks specifically designed to exploit the financial hardship of recipients, manipulating vulnerable victims into handing over valuable data.

So, now is not the time to cut back on cybersecurity, as the cost of cybercrime means it’s just not worth taking the risk.

Good cybersecurity needn’t be daunting

This may all sound worrying, but it really is easy to protect your business, and this doesn’t have to cost the earth. As the UK Government’s Small Business Guide: Cyber Security says: ‘Cyber security needn’t be a daunting challenge for small business owners’. 

However, many enterprises still need to protect themselves sufficiently. According to a report from Kaspersky, as many as a quarter of UK companies admit to underfunding cybersecurity, even though 82% have suffered cyberattacks. Another study also found that one-third of companies with 50 or fewer employees were using free, consumer-grade cybersecurity, leaving themselves more vulnerable to attacks.

A big reason for this could be that protecting your business on a budget can be tricky – employing experts or investing in the latest tools can be costly. However, reliable cybersecurity does not have to be prohibitively expensive or complicated. CyberSmart Active Protect provides robust protection with no need for pricey tools, consultants, or an in-house team. It’s a cost-effective and easy way to secure all employee devices that touch your company data. Simply send a downloadable link to your staff and Active Protect will do the rest, checking 24/7 for the most common cyber threats and vulnerabilities.

So, when you consider the cost of cybercrime and the rising number of attacks, cybersecurity is undoubtedly worth it.

It’s easy to feel overwhelmed by the threat of cybercrime. Last year, cybercriminals stole more than £4 billion from businesses in the UK, which is 63% more than in 2021. 

And unfortunately, small and medium-sized businesses are three times more likely to be targeted than larger companies. They’re generally less equipped to deal with attacks and absorb the associated costs, so 60% are forced to close within six months of an attack.

These numbers, the rising cost of living, and predictions that the UK economy will shrink is a perfect storm for businesses. And with an ever-growing threat, there's an ever-shrinking contingency fund.

But don’t let this get the better of you. It’s important to understand the most common types of cybercrime and take action to mitigate the risk of an attack.

What are the most common types of cybercrime?

1. Hacking

Hackers break into your computers and networks to access data. This unauthorised access can be via brute force to guess your passwords or software like spyware. 

Example

T-Mobile suffered an attack which affected 37 million customer accounts. The hacker stole personal data, like names, birth dates, and phone numbers, through an application programming interface (API) for a month before being detected and stopped. 

Confused about Cyber Insurance? Check out our new guide for everything you need to know.

2. Phishing

Phishing is a type of social engineering attack often used to steal data, such as login details or credit card numbers. Criminals ask recipients to share sensitive information via email or by visiting fake websites that look legitimate but aren’t. A recent State of Phishing report revealed that there were 250 million phishing attacks in 2022. Fortunately, there are some simple ways to avoid an attack.

Example

Developers at DropBox were recently targeted by a phishing campaign that successfully accessed some code stored in GitHub, an internal hosting service for software development and version control. The criminal impersonated another platform and sent emails encouraging developers to log in so they could steal their credentials. Most emails were quarantined by DropBox security systems, but some made it through, and one employee entered their details. The threat actor stole data including API keys and a few thousand names and email addresses of DropBox employees, customers, and leads.

3. Malicious software

Malicious software, or malware, is a type of computer program designed to steal data or damage computers and computer networks. This includes viruses, trojans and worms. Ransomware is also a type of malware, and this kind of attack is on the rise. In 2022, ransomware accounted for 25% of all data breaches. One way attackers can successfully steal data is through unpatched systems with known vulnerabilities.

Example

The Guardian newspaper suffered a ransomware attack in December 2022. It was likely triggered by a phishing email that meant the attacker could access the internal network. Its IT infrastructure was affected but publishing and printing continued with staff being sent to work from home. No customer data was stolen, but the attacker accessed staff data in the incident. 

4. Distributed denial of service (DDoS)

A DDoS attack is designed to stop legitimate users of a website or service from accessing them. An attacker will overload the website with traffic so that it cannot cope or accommodate any more visitors. A hacker will call on hacktivist groups to help them do this or infect innocent users with malware so the hacker can force devices to contribute to the attack.  

Example

A Google Cloud Armor customer recently faced the biggest DDoS attack on record. At its height, there were 46 million requests per second and the attack lasted for just over an hour. Fortunately, Google was able to block the attack.

What can you do to protect your business?

Budgets are certainly stretched at the moment, but the last thing you should skimp on is cybersecurity. Fortunately, there are some straightforward and reasonably priced ways to protect your business from the most common threats. For example, getting a Cyber Essentials or Cyber Essentials Plus accreditation reduces your cyber risk by 98.5%.

The certifications are designed by the UK government and give businesses a standardised level of protection. There are five security controls to help you address cybersecurity effectively. These are:

• Firewalls
• Secure configuration
• User access control
• Malware protection
• Security update management

Its easy-to-follow steps make it simple to secure your business against the most harmful threats. And it costs a fraction of what it would to deal with an attack. You’ll get a great return on investment (ROI) and peace of mind, so it’s a reliable way to protect your business for the future.

39% of UK SMEs reported a cyberattack in 2022 and this figure continues to rise year-on-year. But, while most businesses have some form of cybersecurity in place, surprisingly few have a standalone cyber insurance policy.

What’s holding the UK’s small businesses back? In our latest guide, we look at the key cyber insurance trends set to shape 2023. And, what’s stopping SMEs from taking out insurance?

What’s covered?

We’re taking a deep dive into all things cyber insurance, including:

• The obstacles to SMEs adopting specialist cyber insurance
• An overview of the current cyber insurance market
• The key trends determining the future of the industry
• Why, when it comes to cybersecurity, prevention is better than the cure

So, if you’re considering cyber insurance or just curious as to what it’s all about, check out our guide, Cyber Insurance Trends 2023. It’s a great introduction to the industry and you can download it, for free, here.

Do you run a small charity or legal aid firm? If so, you could be eligible for funded Cyber Essentials certification to help you put basic cybersecurity measures in place. Here’s everything you need to know.

What is the funded Cyber Essentials scheme? 

Small charities and legal aid firms protect and serve some of the most vulnerable in our society. However, unfortunately, they’re also a key target for cybercriminals. The NCSC’s Cyber Breaches Survey 2022 revealed that 30% of UK charities identified a breach in the last 12 months.

The reason for this is simple. Charities and legal aid firms process large volumes of highly sensitive data but often have relatively weak defences – making them an ideal target for cybercriminals.

To counter this, the National Cyber Security Centre and IASME have launched the new Funded Cyber Essentials Programme. This offers small organisations in high-risk sectors free, practical support to help put basic cybersecurity controls in place and achieve Cyber Essentials certification. 

How does the scheme work? 

Qualifying organisations will receive up to 20 hours of remote support with a Cyber Essentials Assessor – all at no cost. Our assessors will spend this time helping you identify and implement the improvements needed to meet the 5 technical controls of Cyber Essentials. We’ll follow this up with an assessment to ensure everything is in place. 

With our guidance, you’ll be ready to take the Cyber Essentials and Cyber Essentials Plus certifications. If it’s not possible for you to complete Cyber Essentials Plus after 20 hours of support, we’ll give you clear directions on how to become assessment ready. 

Is the certification free? 

Yes. IASME has agreed to fund both Cyber Essentials and Cyber Essentials Plus certification for successful applicants to the scheme.

Who is eligible for the scheme? 

To qualify for this scheme, your organisation must be:

• A micro or small business (1 to 49 employees) that offers legal aid services
• A micro or small charity (1 to 49 employees) that processes personal data

No previous cybersecurity experience or certification is required. Even if you’re completely new to cybersecurity, we’ll guide you through the process.

How long is the scheme running for? 

The scheme runs until the end of March 2023. However, it’s worth noting that IASME is offering a limited number of funded packages. So it’s worth getting your application in as soon as possible. 

What is Cyber Essentials?

The Cyber Essentials scheme is a UK-government-backed cybersecurity certification that outlines the security procedures a company should have in place to secure its data. Cyber Essentials is highly recommended for SMEs because this certification protects you against 98.5% of the most common cyber threats.

Cyber Essentials Plus includes all of the same technical controls but with one major difference. Whereas Cyber Essentials is a self-assessed certification, Cyber Essentials Plus includes a technical audit of your systems. This next step gives you 

complete peace of mind your cybersecurity is up to scratch. And, your clients and partners don’t have to take your word for it that you’re cyber secure – they can rely on the expertise of a professional.

Can I apply to the scheme through CyberSmart? 

Yes. As the UK’s leading provider of cybersecurity certifications, we’re proud to be taking part in this scheme. 

To apply for the scheme, head to IASME’s Funded Cyber Essentials page and fill in the form at the bottom of the page. If you’re successful in your application, IASME will pass you over to us (or another certification body) to complete the certification process.

Alternatively, if you’re one of our partners or MSPs and want to refer a customer for the scheme, get in touch. We can apply on your client's behalf and ensure the support and certification is carried out by CyberSmart.

Want to know more about cybersecurity certifications? Check out our in-depth guide to cybersecurity certifications in the UK.

The journey to cybersecurity compliance isn’t easy. You might start at the basics of Cyber Essentials certification and progress to take on the challenge of ISO 27001 compliance. It takes effort to get certified but if you put in the work, you’ll reap the benefits. You could enjoy:

• Greater trust from customers and vendors
• The chance to bid for government contracts
• Protection from cyberattacks
• GDPR compliance

Two of the biggest challenges facing businesses are knowing where to get started and how to build knowledge, but you don’t have to navigate cybersecurity alone. We’ve put together this new, updated guide as your one-stop shop for the three most common UK cybersecurity certifications. 

What’s covered?

In this guide, we outline how to choose the right certification for your business, how to get certified, and where to go for support. 

• Cyber Essentials
  • With information on recent updates
• Cyber Essentials Plus
• ISO 27001
• How to make compliance easy
  • Advice on getting started
• Where to find support

So, if you're unsure about whether your business needs a cybersecurity certification or which one is right for you, start by downloading our guide. It's free and includes everything you need to know to make a decision.

Small business, smaller risk of a cyberattack? Not quite.

Small businesses are still susceptible to cybersecurity threats. Whether your business consists of a single person or a number of employees, you must be protected. 

One in five small firms say they’ve experienced a cyberattack at one point. And many don’t think they have the finances or time to set up security precautions – or in some cases – don’t realise the need to. But it doesn’t have to be this way. 

There are a few simple steps you can take to remain protected. And they could make you eligible for all-important cyber insurance cover.

Why do you need cyber insurance?

Many sophisticated cyber threats exist today. Phishing, malware, ransomware, hacking; the list could go on. Having cyber insurance in your business will help you recover faster if an incident occurs. If your business deals with sensitive customer data, does a lot of business over the internet or doesn’t have coverage from any external cybersecurity providers, cyber insurance is worth investigating.

Cyber insurance includes coverage for damage or loss of information from IT systems and networks. This includes both first-party and third-party risks, depending on your insurance plan.

• First-party risks: This includes anything that could impact your business assets. For example, a cyber-attack on your software or theft of digital assets.
• Third-party risks: This covers the assets of others, like your customers. For example, security and privacy breaches of customer data.

For a small business, cybersecurity insurance is pivotal for protecting you in worst-case scenarios. So, how can a small business obtain cybersecurity insurance?

Not sure where to start with cyber insurance? Check out our guide for everything you need to know.

How to overcome cyber insurance challenges as a small business

Just like any other type of insurance, you need to meet your providers’ criteria. 

Every cybersecurity insurance provider will have its own process, but the typical route to qualify will range from a simple questionnaire to a detailed analysis of your cybersecurity environment by your insurer.

Meeting basic cybersecurity standards will make your small business significantly more likely to qualify. 

Here’s what you can do:

1. Keep software up-to-date and protected

Keeping your software equipped with antivirus protection is a surefire way of avoiding basic cybersecurity threats. And ensuring that all your programs are regularly patched keeps your systems in line with your manufacturer's latest cybersecurity updates. 

By taking these basic measures, insurers will see your business as more trustworthy.

2. Protect your network with a firewall

A firewall is a network security system that monitors and controls your network traffic. Its parameters are based on predetermined security rules across incoming and outgoing traffic. It creates an effective barrier between your network, and anything considered an ‘untrusted’ network – an opportune place for cybersecurity threats to creep in. 

By implementing one, insurers can recognise that you’ve reduced the chance of a cybersecurity threat occurring.

3. Implement regular security checks

Not every small business owner is expected to understand the ins and outs of cybersecurity. Instead, smart cybersecurity software can help you manage regular security checks and provide monitoring, 24/7. 

The best software can also act as an educational tool – providing greater awareness about cybersecurity training opportunities, policies you can implement, and giving your people more control of their own cybersecurity. This shows insurers that you’re taking a proactive approach to cybersecurity.

4. Regularly back up your data

Insurers want you to minimise the risk of data loss as it’s costly and impacts your reputation. 

Make sure your data is backed up using external media or a secure cloud service. Consider that you need to manage and store first-party and third-party data in different ways. 

5. Manage user access rights and permissions

User access rights are an important part of staying secure. You want to make sure only the right people have access to sensitive data, without impacting anyone’s ability to do their actual job. 

In a business, enforcing a ‘least privilege access’ policy is a common way of managing access rights. This is a policy that only allows users to have the minimum level of access or permissions needed to perform their jobs, and nothing more. It restricts access rights to only users, accounts, and processes that require certain types of data.

This creates a safer environment for your data and it helps to protect employees from causing accidental or harmful actions, thus reducing risks for insurers. 

Improve your cyber hygiene to get cyber insurance

‘Cyber hygiene’ is the steps your business can take to protect itself from cyberattacks, like the list above. 

It’s like the practice of washing your hands – but for cybersecurity. Cyber insurance providers look for businesses with good cyber hygiene practices in place, as you’re less likely to be impacted by cyber threats. 

Alongside the list above, a cybersecurity certification is also a great method of overcoming cyber insurance challenges and improving your cyber hygiene. It can provide all the protection you need, and more, and is created by the UK government – making it ideal for small businesses looking for industry-standard protection.

The cost of cyber insurance can vary considerably depending on several factors. For example, the size of your business, the sector it’s in and the sensitivity of the data you deal with. However, in the current cyber threat landscape, the cost to your business of not having any cyber insurance in place could be catastrophic. So, let’s take a closer look at the cost of cyber insurance, what it covers, and what may impact your premiums.

What is cyber insurance and why do you need it?

Just as you insure your car against damage and loss, cyber insurance is a contract between you and an insurer whereby they agree to pay you for any losses you incur related to your IT infrastructure or data management. It’s a relatively new kid on the block in the world of insurance, only thought to have originated in 1997. 

However, with the rapid rise of the Internet, cyber insurance has become increasingly popular. Few businesses can now hope to succeed without some online presence. And, you need to do all you can to protect yourself from cyberattacks and the damage these can do to your company.

The bottom line is that cyber threats have skyrocketed in the last few years, with the rise in hybrid and remote working increasing the vulnerability to attacks of many businesses. In fact, recent research shows that in 2021 there were 50% more cyberattacks per week on corporate networks than in 2020.

If your company is a small or medium-sized business, you could be forgiven for thinking that you’re relatively safe from such threats. After all, media reports typically focus on attacks on large organisations, but this isn’t the case. Threats such as ransomware attacks can affect any company.

For example, the 2021 Verizon Data Breach Investigations Report revealed that 61% of all small and medium-sized businesses had reported at least one cyberattack in the previous year. What's more, 43% of all data breaches involve small and medium-sized businesses. 

According to Hiscox, a small business is hacked in the UK every 19 seconds. And cyber breaches cost the average small business £25,700 in basic ‘clear up’ costs each year. Although there are cybersecurity best practices you can adopt to decrease the likelihood of a successful attack, there's no such thing as complete protection. So, the next best thing is to purchase cyber insurance to help mitigate the risks and possible effects of a cyberattack.

Want to protect your business but unsure where to start? Check out our free guide to cyber insurance.

What’s the cost of cyber insurance?

There are two main costs when you take out cyber insurance:

• Your insurance premium: This is the basic cost of your insurance protection, payable monthly or yearly
• Your insurance excess: This is the lump sum that you pay if you make a claim. If you choose a small excess, this will usually make your insurance premium more expensive

As with all insurance, the cost of cyber insurance to your business depends on various factors:

• The size of your business: This can be a strong influencing factor on the cost of cyber insurance. The more staff you have, the higher the risk of you falling foul of phishing and social engineering attacks. A company with a large annual turnover is normally more expensive to insure than a smaller business
• Your business sector: Certain industries are more vulnerable to cyberattacks than others. For example, a finance organisation or charity may be at higher risk than a restaurant
• The strength of your cybersecurity: If the cybersecurity measures you have in place are robust, you may be rewarded with lower insurance premiums. It, therefore, pays to employ strong security protocols and educate your staff on cyber risks
• The amount and sensitivity of the data you deal with: If your business has a small customer base, or doesn’t hold a lot of sensitive data, you may pay less for your cyber insurance. For instance, a healthcare facility that stores lots of
  
  highly sensitive personal information will usually pay more than a hairdresser
• The level of cover you choose: If you opt for a basic policy, providing limited protection, it’s likely to be less expensive than a more comprehensive policy

Picking the right type of cover

Cyber insurance falls into two main types. And it’s important to choose the right one for your business. 

• First-party cover: This protects your company against the direct results of a cyberattack
• Third-party cover: This includes the indirect consequences of a cyberattack. It also provides protection for businesses that offer professional services to other businesses. For example, if you’re being sued by another company for errors you’ve made which have resulted in damages

First-party insurance is usually less expensive than a third-party policy.  However, it doesn’t provide as much protection. Not all businesses need third-party protection, but organisations that are mostly technology-based will probably need to consider it.

What cover do you get for the cost?

Cyber insurance will cover you for a range of cyber risks, including:

• Malware, including ransomware attacks
• Denial-of-service attacks
• Social engineering attacks, including phishing
• Data privacy breaches

Although it's difficult to estimate exactly what your cyber insurance costs might be (every business is different), it should cover you for:

• Loss of income
• Repair costs and damage control
• Fines and legal action, such as GDPR violation charges
• Ransom costs, if someone holds your data hostage
• Public relations support, to regain damaged trust
• Data breach measures, including investigative proceedings and customer support

Is the cost worth it for small businesses?

Despite the benefits of having cyber insurance, it's still underused. The DCMS' Cyber Security Breaches Survey 2022 found that only 43% of businesses have a cyber insurance policy. For many businesses, this is down to cost. Prices rose in the UK by 102% in the first quarter of 2022 alone.

So, is it worth it?

At the end of the day, an insurance policy won’t protect you from a cyberattack happening. Only strong cybersecurity can do this. But, given the speed and sophistication of cyberattacks, being hit as a small business isn’t a question of if it will happen, but when.

So, cyber insurance can be invaluable, as it will help to put you back into the state you were in before an attack took place. Your insurer can also provide skills and expertise, such as ransomware negotiation, PR cover, and data recovery skills that you might not have in-house.

The cyber insurance market is changing

Protecting your business on a budget can certainly be tricky, but new products are now disrupting the insurance space and offering more cost-effective solutions. Cyber insurance is evolving and CyberSmart is at the forefront of this revolution. 

The traditional, standalone cyber insurance model, without protection or monitoring, is fast becoming obsolete and driving substantial premium increases. Providing insurance before managing the risk is fundamentally flawed, leading to suboptimal outcomes for the insurer and the insured. However, CyberSmart takes a more holistic view of risk, not just looking at technology, but also at processes and people to reduce the level of cyber risk as a whole. 

With CyberSmart Active Protect, you can proactively manage risk 24/7. It identifies risks and provides simple, jargon-free instructions for fixing vulnerabilities. Our user-friendly platform ensures everyone in your business is working safely, with visibility of every device in your organisation.

In addition, we also offer £25k worth of enhanced cyber insurance for free with Cyber Essentials certification completed. So you can minimise your risk of cyberattacks, gain peace of mind, and cover yourself with affordable insurance, in case the worst should happen.

If you’re considering cyber insurance or just curious as to what it’s all about, check out our guide, Cyber Insurance Trends 2023. It’s a great introduction to the industry and you can download it, for free, here.