Cyber cover prices are falling and insurers are trying to ease the buying process for SMEs to encourage take-up, industry figures have told a parliamentary inquiry.

Representatives from the Insurance Council of Australia, QBE and Marsh said coverage among smaller businesses is low: QBE estimates about 20% of Australian SMEs have cyber insurance, compared with 70%-75% of larger organisations.

But they rejected a suggestion that policyholders are reluctant to report cyberattacks for fear of their premiums rising.

ICA GM for regulatory and consumer policy Alexandra Hordern told the House Select Committee on Cybersecurity for Small to Medium-Sized Businesses: “The longer [breaches] go on without addressing the root cause, they will cost much more than the potential impact on the premium.”

And QBE global head of cyber Serene Davis said: “If you report a cyberattack, what you’re doing is calling an incident response team and helping get the people you need in the door as quickly as possible.”

Marsh head of cyber Brylee Jaghbir said there is a “persistent misconception” that the cover is “expensive, inaccessible and designed only for large corporates”.

Related article: Business survey reveals AI breach threat, and gaps in security

She said Marsh analysis shows an overall price fall of 8% in the last quarter across all its markets, following a 6% drop in the preceding quarter.

But Ms Horden noted only 6000 cyber policies were written in the March quarter – less than 0.2% of all general insurance policies.

Ms Davis said several years ago “when the market was more difficult, we had a lot of underwriting questions and it could feel quite complex to get cyber insurance.

“We’ve come a long way and for small companies we really reduce the question sets.”

Ms Horden said many insurers now “build prevention into the policy rather than selling it as an add-on, helping their customers build stronger defences and better understand their own risk”.

Among ICA’s recommendations to reduce risk and increase SME cyber resilience are a program of government-funded training for business owners and staff, and for de-identified cyber threat data collected by government to be shared with insurers.