Singapore — Around 42% of small and medium-sized enterprises (SMEs) assessed across six ASEAN markets would require cyber remediation before they could be considered insurable, according to the latest data from Cygienic.
According to the findings, large corporations recorded an insurability readiness rate of 71%, compared with 58% among SMEs. The company said this meant 29% of large corporations and 42% of SMEs assessed required remediation.
The report also said the results point to a gap between meeting the requirements for cyber insurance and maintaining sufficient resilience against cyber threats.
“The opportunity here is to stop treating cyber insurance as a pass-or-fail transaction. For SMEs that fall short today, the answer does not have to be ‘no’. Brokers can help identify the gaps, establish a remediation pathway and demonstrate measurable improvement. Once insured, continuous monitoring can help ensure that the risk does not simply deteriorate again,” said Barnaby Grosvenor, Founder and CEO of Cygienic.
The company said the findings support a more continuous approach to cyber insurance, in which risk assessment and remediation take place alongside ongoing monitoring rather than being limited to the underwriting process.
The assessment also produced a different result in one area of cyber exposure. Cygienic said SMEs had fewer exposed email credentials than large corporations, with 760 credentials identified on the dark web among SMEs compared with 6,066 associated with large corporations.
Despite that finding, the company said SMEs continued to lag behind larger organisations across most of the technical controls included in the assessment. It attributed the wider resilience gap in part to SMEs having fewer financial and technical resources available for cybersecurity and continuous external monitoring.
The company is advocating a model in which insurers and brokers use cyber-risk assessments to identify weaknesses and establish remediation plans for businesses that do not initially meet insurance requirements.
Under this approach, the insurance process would incorporate remediation and continued monitoring, with businesses able to demonstrate changes in their cybersecurity posture over time.
Cygienic said such an approach could give SMEs a clearer route towards improving their resilience while providing insurers and brokers with greater visibility of cyber risk throughout the policy lifecycle.
