Briefing: Behavioral and Informational Drivers of SME Cyber Insurance Decisions in Germany

Executive Summary

This document synthesizes the findings of an empirical analysis of the factors influencing the cyber insurance purchasing decisions of German Small and Medium‑sized Enterprises (SMEs). Based on a questionnaire survey of 1,248 SME executives, the research identifies a significant gap in the market: despite the increasing threat of cyberattacks, SMEs remain reluctant to purchase cyber insurance, with large corporations representing 81% of the market share compared to just 18% for SMEs.

The study reveals that SME decisions are heavily influenced by specific behavioral and informational factors. The most critical takeaways are:

• Financial Impact and Anxiety are Key Drivers: The estimated financial cost and the level of anxiety about a potential cyberattack are significant positive predictors of purchasing cyber insurance. A one‑unit increase in perceived financial impact (on a six‑point scale) increases the likelihood of purchase by 40.3%, while a similar increase in anxiety (on a seven‑point scale) raises it by 30.3%.
• Probability and Experience are Not Significant: Counterintuitively, the perceived probability of an attack and prior personal experience with successful cyberattacks do not significantly influence the decision to buy insurance. This is likely due to the difficulty SMEs face in accurately estimating cyber risk probabilities.
• External Expertise Outweighs Internal Assessment: Assistance from external cybersecurity specialists has a significant positive impact on insurance demand. In contrast, an organization's internal cyber risk assessment has no significant influence, suggesting SMEs lack the internal capability for effective risk evaluation.
• Internet Research has a Negative Effect: Independent Internet research significantly decreases the likelihood of an SME purchasing cyber insurance. A one‑unit increase in reliance on the Internet as an information source reduces the probability of purchase by 38.2%. This is attributed to information overload, which overwhelms SME decision‑makers.
• Firm Size Matters: The demand for cyber insurance increases significantly with firm size. Micro‑enterprises are 72.6% less likely to purchase cyber insurance than large enterprises.

These findings suggest that to increase cyber insurance penetration in the vital SME sector, insurers should develop marketing and distribution strategies that make risks tangible, focus on financial consequences and emotional responses, and leverage external experts to overcome SME resource constraints and information overload.

--------------------------------------------------------------------------------

1. Context: The SME Cyber Insurance Gap in Germany

Small and Medium‑sized Enterprises (SMEs) are the backbone of the German economy, representing 99.3% of all businesses and generating 27.3% of the country's total turnover in 2022. Despite their economic significance, they are increasingly targeted by cyberattacks, with a 12% rise in affected enterprises from 2022 to 2023. The average financial loss for an SME following a successful cyberattack is estimated at €66,812.

Despite this clear and growing threat, a significant gap exists in cyber insurance coverage. While large corporations are the primary customers, SMEs remain hesitant.

• Low Penetration: A 2024 Gothaer survey found that only 25% of 1,022 surveyed German SMEs have cyber insurance.
• Market Share Disparity: According to Germany's Federal Financial Supervisory Authority (BaFin), in 2023, large corporations accounted for 81% of the total cyber insurance market share (by premium income), while SMEs accounted for only 18%.

This reluctance is counterintuitive, as SMEs face particular challenges in cyber risk management‑such as resource constraints, limited technical skills, and a lack of IT experts‑that the assistance services included in cyber insurance policies (e.g., 24/7 claims hotlines, data recovery specialists) are designed to address. The research aims to uncover the behavioral and informational factors driving this discrepancy.

2. Research Overview and Methodology

The analysis is based on data from a standardized online questionnaire completed by 1,248 German SME executives. The study's objective was to evaluate the influence of behavioral factors (risk perception, prior experience, confidence, anxiety) and information sources (internal assessment, external experts, Internet research) on the decision to purchase cyber insurance.

The core research method employed was a logistic regression analysis to determine which factors significantly predict whether an enterprise demands cyber insurance. The final sample consisted of:

• Micro‑enterprises (up to 9 employees): 23.5%
• Small enterprises (10‑49 employees): 45.8%
• Medium‑sized enterprises (50‑249 employees): 21.8%
• Large enterprises (>249 employees): 9.0%

Of the respondents, 67.3% were members of the management board and 43.3% were responsible for IT.

3. Key Determinants of Cyber Insurance Demand

The logistic regression model identified several factors that significantly influence an SME's decision to purchase cyber insurance. The findings challenge conventional assumptions about risk assessment and highlight the power of emotional and external influences.

3.1. Behavioral Influences: Perception, Emotion, and Experience

The study confirms that subjective and emotional factors play a crucial role in decision‑making, while objective experience and rational probability estimates do not.

3.2. Information Sources and Decision‑Making Processes

The way SMEs gather information and seek advice is a critical factor, with a stark contrast between the value of professional guidance and the negative impact of independent online research.

3.3. Organizational Characteristics

Consistent with market data, firm size was confirmed as a major determinant of cyber insurance demand.

• Hypothesis: Smaller enterprises purchase significantly less cyber insurance than larger organizations.
• Result: Confirmed.
  • Micro‑enterprises are 72.6% less likely to purchase cyber insurance compared to large enterprises.
  • Small enterprises are 64.2% less likely to purchase cyber insurance compared to large enterprises.
  • The difference between medium‑sized and large enterprises was not statistically significant.

This finding runs contrary to the bankruptcy cost hypothesis, which posits that smaller firms should value insurance more due to higher relative bankruptcy costs.

4. Summary of Hypotheses and Results

The following table provides a consolidated view of the study's hypotheses and the outcomes of the logistic regression analysis.

5. Practical Implications and Conclusion

The research provides actionable insights for insurers, policymakers, and SME support organizations aiming to improve cyber resilience.

• For Insurers:
  • Marketing Focus: Shift marketing from abstract probabilities to tangible financial consequences. Use vivid case studies and scenarios to increase perceived financial impact and anxiety.
  • Emphasize Service, Not Just Indemnity: Highlight the value of assistance services (e.g., incident response, legal support) that address SME resource and expertise gaps.
  • Distribution Channels: Collaborate with external IT service providers and cybersecurity consultants, as they are trusted advisors and a key positive influence on SMEs' decisions.
  • Simplify and Customize: Develop clear, simple, and well‑suited cyber insurance products for the heterogeneous SME segment to combat information overload and unlock significant market growth potential.
• For SMEs and Policymakers:
  • The study underscores the challenges SMEs face in self‑assessing complex risks. This points to a need for greater access to affordable external expertise.
  • Given the critical economic role of SMEs, enhancing their protection against cyber risk through better insurance access contributes to the overall stability of the German economy.

The study concludes that behavioral biases and information processing challenges significantly shape the SME cyber insurance market. By understanding that decisions are driven more by the perceived magnitude of loss and emotional anxiety than by rational probability calculations, stakeholders can more effectively communicate the value of cyber insurance and help close the critical protection gap.