Cyber liability insurance for SMEs: coverage gaps, claims, and risk transfer

Introduction

Cyber attacks are no longer just a concern for big corporations—they're a critical threat to Belgian SMEs. According to Munich Re's 2026 cyber insurance insights, the majority of cyber incidents and claims now affect micro-companies and SMEs, not Fortune 500 companies. Yet many SMEs operate with dangerously incomplete protection: they either lack cyber liability insurance entirely or carry policies with significant coverage gaps. This creates a perfect storm: if a breach happens, the financial fallout can be catastrophic. Incident response costs, legal fees, regulatory fines, and business interruption losses can quickly exceed €1 million. This article breaks down what cyber liability insurance really covers, why gaps exist, and how to ensure your SME is properly protected in 2026.

1. Understanding Cyber Liability Insurance

Cyber liability insurance is not a single coverage—it's a layered protection system designed to cushion the financial impact of cyber incidents. The NetDiligence Cyber Claims Study documents a five-year average incident cost of €850,000 for SMEs (those with revenue below €2 billion). These costs typically include:

• Incident response and forensics: Hiring digital forensics experts to contain and investigate the breach (€50,000–€200,000)
• Business interruption: Revenue lost during downtime and recovery
• Data breach notification: Legal requirements to notify affected customers, plus credit monitoring services (€100,000–€500,000 for a moderate breach)
• Regulatory fines: GDPR and NIS2 penalties can reach millions if negligence is proven
• Ransom and extortion: Ransomware claims and cyber extortion demands
• Reputational damage: Third-party crisis management and public relations

For Belgian SMEs, this is amplified by European regulations. The EU's Network and Information Security Directive (NIS2), now in effect, mandates specific cyber protection standards. Companies falling under NIS2 scope must register with Belgium's Centre for Cybersecurity (CCB) and demonstrate compliance through recognized frameworks. A cyber incident without proper insurance creates dual liability: the financial loss plus regulatory penalties.

2. Coverage Gaps: Where SMEs Get Exposed

While awareness of cyber risks has increased following high-profile attacks in 2025, many SME decision-makers suffer from what Coalition calls "misplaced confidence in general coverage." This creates dangerous gaps:

Gap #1: Reliance on General Business Insurance. Many SMEs assume their existing property or liability policies cover cyber incidents. They don't. General business insurance typically excludes cyber losses entirely—especially network damage, data loss, and intellectual property theft.

Gap #2: Inadequate Liability Limits. Standard SME cyber policies often cap coverage at €250,000–€500,000. For a mid-sized company processing customer payment data or employee information, a single breach can exceed these limits within days of discovery.

Gap #3: Failure to Cover Third-Party Data. Most basic policies cover your own data loss, but not the personal or business data of your clients, vendors, or partners. If your breach exposes customer credit cards, you're liable—but your policy may not cover it. AIG Belgium, a major cyber insurer, emphasizes that comprehensive policies must insure "the loss of personal data, but also the business data of third parties, including intellectual property."

Gap #4: Thin Coverage for Incident Response. Insurers typically require certified incident response (IR) professionals. But many SMEs don't pre-arrange IR partners or understand what the policy will actually pay for. When a breach occurs, delays in initiating the claim can invalidate parts of the coverage.

Gap #5: AI and Emerging Threat Exclusions. As of 2026, new cyber policies are introducing exclusions for losses caused by AI-generated attacks or security failures related to inadequate AI safeguards. SMEs using AI tools without proper security protocols may find claims denied.

3. How to Assess Your Coverage and Plug Gaps

Step 1: Audit What You Actually Have. Request a detailed coverage schedule from your current insurer. Check specifically for:

• Data breach response and notification costs
• Business interruption coverage (measured in hours, days, or percentage of revenue)
• Regulatory defense costs (fines, investigation fees)
• Third-party liability (if your breach harms customers or partners)
• Ransomware and cyber extortion coverage

Step 2: Map Your Cyber Risk. What data do you hold? How many customers, employees, or partners depend on your systems? A manufacturer with 150 employees and detailed IP faces different risk than a service firm with 20 staff. Document your exposure honestly—insurers will investigate claims thoroughly.

Step 3: Understand Insurer Requirements. Modern cyber policies require demonstrable security controls before claims are paid. Common prerequisites include:

• Multi-factor authentication (MFA) on all remote access
• Regular patching schedules (quarterly minimum)
• Documented incident response plans
• Employee security awareness training
• Network segmentation and backup procedures

If your SME doesn't meet these baselines, some insurers will deny claims. More commonly, they'll offer a discount if you implement controls.

Step 4: Choose the Right Policy Structure. Belgian SMEs typically face two options:

• All-in-one cyber liability policy (e.g., AIG's Quotepad for SMEs): Covers data breach notification, legal defense, regulatory response, business interruption, and incident response in one package. Easier to understand; typically €2,000–€5,000/year for €500,000 coverage.
• Standalone cyber policy + liability endorsement to existing policy: Separates cyber from general liability. May offer more granular control but requires coordination between insurers.

4. Real Claims: What Actually Gets Paid?

The Hartford and Coalition have published real examples of SME cyber claims. Here's what typically succeeds:

Claim Type 1: Ransomware with Business Interruption. A mid-size logistics firm in Antwerp was hit by ransomware that encrypted their shipping management system. Their cyber policy covered:

• Forensics: €80,000
• System restoration and software licensing: €45,000
• Business interruption (5 days × daily revenue): €120,000
• Total paid: €245,000

Claim Type 2: Data Breach with Notification Costs. A Brussels-based HR consulting firm's employee database was compromised. Affected parties: 2,400 individuals. Coverage included:

• Incident response team: €60,000
• Notification and credit monitoring: €75,000
• Regulatory investigation support: €30,000
• Total paid: €165,000

Claim Type 3: Denial of Service (DoS) Attack with Revenue Loss. An e-commerce SME suffered a three-day DoS that prevented sales. Coverage included:

• Forensics and IR: €35,000
• Business interruption (3 days × revenue): €95,000
• Network restoration: €20,000
• Total paid: €150,000

Conversely, claims are denied when:

• The SME failed to maintain baseline security (no MFA, no backups)
• The breach was caused by employee negligence that the SME knew about but didn't address
• The SME didn't have an incident response plan and delayed reporting, worsening the impact
• The cyber loss was secondary to a non-cyber event (e.g., a fire that caused data loss)

5. The Role of Risk Transfer in SME Strategy

Cyber liability insurance is part of a broader risk management strategy. It doesn't replace good security—it supplements it.

What insurance covers: The financial fallout after a breach.

What insurance doesn't cover: Preventing the breach in the first place.

This is why insurers now require security controls as a condition of coverage. For Belgian SMEs, the smart approach is:

1. Implement foundational security: MFA, patching, backups, incident response planning.
2. Measure your risk exposure: How much data do you hold? What's the cost of downtime? What are your regulatory obligations?
3. Buy appropriate insurance: Match your policy limits to your actual exposure, not just a budget ceiling.
4. Document everything: Maintain evidence that you've implemented required controls. When a claim comes, this documentation accelerates approval.

Risk transfer via cyber liability insurance shifts the post-incident financial burden to the insurer, freeing capital for recovery and business continuity instead of bankruptcy.

Key Takeaways

1. Average SME incident costs reach €850,000–€937,000. Without insurance, most SMEs cannot recover financially from a significant breach. Cyber liability insurance is not optional—it's a critical business expense.

2. Coverage gaps are endemic. Even SMEs with cyber insurance often discover too late that their policy excludes third-party data, AI-related losses, or regulatory fines. A detailed audit of your current coverage (or proposal) takes 2–3 hours and prevents catastrophic surprises.

3. Baseline security is a policy requirement, not optional. Insurers now mandate MFA, regular patching, documented incident response plans, and employee training. SMEs without these controls will face claim denials. Implementing them before purchasing insurance also reduces premiums by 15–25%.

4. Belgian regulatory environment (NIS2, GDPR) increases liability. If your SME falls under NIS2 scope, regulatory fines can add €250,000–€5 million on top of direct incident costs. Cyber liability policies that include regulatory defense coverage are essential.

5. Omnistack's managed IT services reduce both risk and insurance costs. Our proactive monitoring, patch management, and incident response planning help your SME meet insurer requirements, qualify for better rates, and recover faster if an incident occurs.

Next Steps

This week: Request a detailed coverage schedule from your current insurer (or broker). Ask specifically what your policy covers for data breach notification, business interruption, and regulatory fines. If you don't have cyber liability insurance, request quotes from at least two providers (e.g., AIG Quotepad, KBC Cyber Insurance).

Weeks 2–4: Audit your current security controls. Check: Do you have MFA on remote access? Is your backup/disaster recovery plan tested? Do you have a documented incident response plan? If the answer to any is "no," flag these as quick wins—implementing them reduces insurance premiums and lowers your cyber risk significantly.

Months 2–3: Once you've understood your coverage and security gaps, meet with a broker or insurer to align your policy with your actual risk exposure. Avoid over-insuring (paying for coverage you don't need) or under-insuring (gaps that could bankrupt you).

Months 3–6: Work with Omnistack to implement the security controls your insurer requires. We'll help you establish patch management, employee training, backup testing, and incident response procedures—turning insurance requirements into operational strengths.

Need expert guidance? Contact Omnistack to discuss how our managed IT services reduce your cyber risk and align with your insurance requirements.

Conclusion

Cyber liability insurance is no longer a nice-to-have for Belgian SMEs—it's essential infrastructure. With average incident costs exceeding €850,000 and regulatory penalties adding millions more, the financial impact of an uninsured breach can be existential. But insurance alone is not enough. The SMEs that thrive in 2026 are those that combine smart risk transfer (insurance) with proactive risk reduction (security controls and incident planning). Start with an honest audit of what you have today, identify the gaps, and close them methodically. Your data, your customers, and your survival depend on it.

---

🔗 Related Articles:

• Cybersecurity basics for Belgian SMEs: a practical 90-day checklist
• Incident response planning: creating a plan before disaster strikes
• IT budget planning for SMEs: ROI, cost optimization, and vendor management