Content area
As technology advances, businesses adopt new innovations to stay competitive. However, these advancements also introduce cyber risks. While medium- and large-sized businesses typically have the resources to manage these risks, microbusinesses often struggle. Larger businesses invest in cybersecurity departments, trained personnel, and advanced tools, but such measures require substantial resources. As a result, microbusinesses may consider risk transfer, such as cyber insurance. Despite its availability, this study observes that most microbusinesses have yet to obtain cyber insurance.
This dissertation focuses on microbusinesses with fewer than 10 employees located in Arlington, Virginia, and surrounding areas. It identifies three primary barriers preventing these microbusinesses from obtaining cyber insurance: limited resources, lack of awareness of cyber risks, and insufficient understanding of cyber insurance.
Data collection was conducted through interviews with business owners. The research aimed to determine which of the three barriers most significantly hinders cyber insurance adoption. It also explored related factors, such as existing risk response strategies, data backup practices, ransomware awareness, and mitigation measures. By analyzing these responses, the study highlights cyber risk aversion and lack of awareness as key obstacles.
The findings suggest that lack of awareness and risk aversion outweigh financial constraints as barriers to cyber insurance adoption. If unaddressed through training, education, and guidelines, these challenges may leave microbusinesses vulnerable to cyberthreats. Given that microbusinesses comprise 78.5% of U.S. businesses, this has implications for national security and the economy (SBE Council, 2022). The study recommends integrating cyber insurance as a complementary risk management tool and establishing awareness programs to help businesses recover from cyberattacks such as ransomware. Additionally, cyber insurance providers can capitalize on this opportunity to extract meaningful insights from interview responses. These insights can inform the development of best practice guidelines that not only increase awareness of cyber risks but also underscore the critical role cyber insurance plays in responding cybersecurity risks and reducing the financial impact of cyber incidents on microbusinesses.
