Ask most brokers what slows down a cyber placement, and the answer is rarely the market. It is the proposal form. A client who has never thought hard about their own security is suddenly asked about multi-factor authentication, backups, patching, privileged access and incident response, and the answers come back late, vague or, worst of all, optimistic.

That gap between what a client believes about their security and what is in place is where cyber business gets difficult. It slows quotes, weakens terms and, if it surfaces after an incident, puts the broker in a very uncomfortable position.

There is also a harder truth for brokers. To advise well on cyber, you need to understand it well enough to answer a client’s questions with confidence, explain why an insurer is asking for a particular piece of information, and set out what happens if the answer falls short. That is a lot to ask on top of everything else a broker covers. Cyber threats change month by month, insurers’ questions change with them, and the technical detail can be daunting for a broker and a client alike.

No one expects their broker to be a security expert. Clients do expect their broker to know where to find one. Bringing in a specialist to assess a client’s cyber risk does not take anything away from the broker’s role. It shows that you know the subject well enough to see when it needs expert input, and that you are willing to bring in the right people to get it right. For many clients, that is exactly the kind of broker they want to work with.

A proper cyber risk assessment closes that gap before it becomes a problem.

The market is growing, but the gap is still wide

Demand for cyber cover is rising. The Association of British Insurers reported that cyber policy sales rose 17% in 2024, and insurers paid out £197 million in cyber claims to UK businesses that year, up 230% on 2023. Malware and ransomware accounted for 51% of claims, up from 32% the year before. [1]

Yet standalone cyber cover is still the exception rather than the rule. The government's Cyber Security Breaches Survey 2025/2026 found that while 47% of businesses have some form of cyber insurance, only 10% hold a specific standalone cyber policy. Among medium businesses, that figure rises to 24%, and among large businesses to 32%. [2]

The same survey found that 43% of businesses had experienced a cyber breach or attack in the previous 12 months, rising to 65% of medium businesses and 69% of large ones. [2] The appetite and the exposure are both there. What is often missing is the evidence that turns a hesitant client into an insurable one.

Most clients have never formally assessed their cyber risk

According to the same government research, only 30% of UK businesses carried out a cyber security risk assessment in the last year. Just 15% reviewed the risks posed by their immediate suppliers, and only 25% had a formal incident response plan in place. [2]

For a broker, those numbers explain a lot. If seven in ten clients have never formally assessed their own cyber risk, it is no surprise that proposal forms come back incomplete or that good-faith answers don't hold up under scrutiny. The client is not being evasive. They simply do not know.

What a broker needs from a cyber risk assessment

An Infoprotect cyber risk assessment that is genuinely useful to a broker does four things.

First, it gives you facts rather than assumptions. When a client says they have multi-factor authentication, you want to know whether that means every remote access point and every privileged account, or just email. An independent assessment answers the questions underwriters are going to ask, with evidence behind the answers.

Second, it speaks the underwriter's language. A long technical report full of vulnerability scores is of limited use at the point of placement. What helps is a clear view of the controls insurers care most about, where the client meets them, where they fall short and what it would take to close the gap. That makes the submission stronger and the conversation with the market shorter.

Third, it gives you something to advise on. An assessment that identifies practical improvements, ranked by how much they matter, turns the broker into the person who helped the client get better terms rather than the person who delivered bad news at renewal. That is a far stronger position, and it keeps clients loyal.

Fourth, it protects you. Where a client's answers on a proposal form turn out to be inaccurate, the consequences can land at claim stage. An assessment before placement creates a clear record of what was in place and what was recommended, supporting good disclosure and reducing the risk of later disputes.

Why this matters more for SMEs and mid-market clients

Large corporates usually have a security team, a chief information security officer and a stack of documentation to hand. The clients who benefit most from an independent assessment are typically the ones in the middle: growing businesses with real data, real revenue at risk and no in-house security function.

These are also the clients most likely to see cyber cover as optional. The National Cyber Security Centre handled 429 cyber incidents through August 2025, 204 of them nationally significant, more than double the previous year. [3] When attacks of that scale make headlines, an uninsured mid-sized business carries significant risk on its balance sheet. An assessment helps a client understand their exposure in concrete terms, making the case for cover much easier.

Turning assessment into a renewal conversation

The real value of a cyber risk assessment is not confined to new business. When repeated annually or supported, it gives brokers a structured way to show progress. A client who has closed measurable gaps since last renewal has a better story to tell the market, and a broker who can demonstrate that improvement adds value well beyond the placement itself.

It also gives you a reason to be in touch between renewals. Instead of a once-a-year form-filling exercise, the relationship becomes an ongoing conversation about risk, which is exactly where brokers want to be.

How Infoprotect works with brokers

At Infoprotect, our cyber risk assessments are designed with brokers in mind. We focus on the controls insurers care about, present findings in plain English and give clients a practical, prioritised plan they can act on. Brokers, including Clear Insurance Management, have used our assessments to support their clients and strengthen submissions to the market.

“As a broker specialising in cyber and technology risk, I referred a client to Infoprotect because they needed to close gaps in their cyber resilience before we could take their risk to the insurance market. Infoprotect's assessment identified the areas underwriters were most concerned about, and their remediation support meant the client was able to demonstrate a genuinely improved risk profile rather than just a paper exercise. That made a real difference in placing the cover, and we secured terms with a proportionately reduced premium cost. It's exactly the kind of technical, insurance-literate cyber risk work that makes a broker's job easier and gets better outcomes for clients.” George Grimshaw – Clear Group, Divisional Head of Cyber and Technology.

If you have clients who struggle with cyber proposal forms, who are uninsured because they are unsure where they stand, or who are heading into a difficult renewal, we would be glad to talk about how an assessment could help.

Call Hazel Richardson on (0)7570 003027 or email Hazel.Richardson@infoprotect.co.uk

Your clients get a clear picture of their cyber risk. You get a stronger submission and a better conversation with the market.

Sources

[1] Association of British Insurers, Nearly £200 million paid in cyber claims to help UK businesses recover, November 2025. https://www.abi.org.uk/news/news-articles/2025/11/nearly-200-million-paid-in-cyber-claims-to-help-uk-businesses-recover/

[2] Department for Science, Innovation and Technology, Cyber Security Breaches Survey

2025/2026, published 30 April 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026

[3] National Cyber Security Centre, UK experiencing four 'nationally significant' cyber attacks every week, 14 October 2025 (NCSC Annual Review 2025, covering 1 September 2024 to

31 August 2025). https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly