Small businesses, big risks: Rethinking resilience for SMEs

SMALL and medium-sized enterprises (SMEs) are the backbone of the economy – yet remain structurally underinsured.

In Singapore, SMEs make up 99 per cent of all businesses, employ around 70 per cent of the workforce and contribute nearly half of gross domestic product.

These numbers underscore their foundational role in economic growth and social stability. Yet despite their importance, SMEs are underprepared for the increasingly complex risks they face.

A ransomware attack that can be weathered by a multinational might cripple a small business; a flood near a logistics hub could paralyse operations. SMEs face risks similar to those of large enterprises, but have far fewer resources to absorb the shocks that occur when these risks manifest.

Most support available to SMEs is designed for a simpler time. Insurance offerings, advisory models and preparedness tools still reflect the assumption that smaller businesses face smaller risks.

The result is a widening gap – not just in coverage, but in resilience.

Commercial insurance products were traditionally designed for large enterprises, then scaled down for smaller firms. But SMEs operate differently. They are leaner and often embedded in fragile supply chains, with increasingly complex risk profiles.

This calls for a shift in how SME risk is assessed, managed and mitigated. Coverage should be modular and tailored to sectors. Underwriting processes should be simplified, and clearer guidance must be provided on emerging threats like cybercrime and climate disruption.

Furthermore, these solutions must be accessible not just in cost, but also in delivery.

Tech-enabled, threat-exposed

The technological advancements that help SMEs grow have also exposed them to new risks.

Cyberthreats are one example. These are increasingly sophisticated, targeted, and often devastating for smaller firms without dedicated IT teams or resources.

However, many SMEs hold insurance policies that do not reflect their digital exposure.

Cyberinsurance is often built for enterprise-grade environments, with assumptions of in-house security and 24/7 monitoring. For SMEs, coverage can be expensive or inaccessible because their systems fall short of minimum-security requirements.

A Cyber Security Agency of Singapore (CSA) survey found that only one in three companies had adequate cybersecurity measures. The top barriers were a lack of knowledge, limited resources, and the mistaken belief that they are too small to be targeted.

Advisory and awareness

There is a critical need for greater advisory and education. Most SMEs do not work with specialist brokers or internal risk managers, and their exposure assessments are often based on instinct rather than data.

Compounding this issue is a false dichotomy in how insurance is perceived: that a business is either insurable or it is not. There is little awareness of how insurers can help SMEs become insurable.

With cyber risk, many SMEs assume they are ineligible due to their limited controls or infrastructure. They may not know that they can get support to improve their risk posture – from vulnerability profiling to attack surface assessments – and thus become eligible for coverage.

For instance, SMEs can tap CSA’s Chief Information Security Officer-as-a-Service scheme for help with implementing cybersecurity measures aligned with the agency’s Cyber Essentials mark.

CSA offers up to 70 per cent co-funding for eligible SMEs to engage cybersecurity consultancy services.

Meanwhile, some insurers are rethinking how support for these businesses is delivered. Resilience checks are being introduced at the front end of the insurance process, and risk guidance is integrated into digital tools that SMEs already use.

For instance, digital banking apps may offer risk self-assessments or alerts, based on SMEs’ transactions or industry profile. Logistics or wholesale purchasing platforms can flag what sort of cargo insurance may be needed, given the shipping routes, order volume or type of cargo.

These efforts recognise that enabling resilience before an event is far more valuable than compensating for loss after the fact.

Singapore’s role as a regional hub makes this especially urgent. SMEs are increasingly internationally focused, tech-enabled and exposed to global disruptions. As they scale, their risk exposure grows.

To meet these evolving needs, the insurance industry must move beyond retrofitting enterprise-grade products to SMEs. Instead, it should design solutions built around how small businesses operate.

This includes modular coverage with easy-to-understand terms; scalable offerings; digital access through platforms SMEs already use; and embedded advisory tools for informed decision-making.

But even these innovations will fall short without broader collaboration. Government agencies can incentivise and subsidise tools and services, as CSA is doing. Business associations can raise awareness and provide education. SMEs themselves must invest in understanding their exposure early, recognising insurance as an enabler of growth and not just a reactive cost.

If SMEs are the backbone of the economy, then building their resilience must be a shared responsibility.

The writer is Zurich Insurance’s head of commercial insurance and chief technical officer, Asia-Pacific