Ask a room of MSPs how many of their clients carry cyber insurance, and it is unlikely that you will get a clean number back. What comes through instead is a pattern. A lot of small and midsize businesses do not carry it, and most of the ones who skip it have never really understood why it matters in the first place. The exact percentage moves around. The underlying truth does not. For the majority of SMBs, cyber insurance is either absent or barely understood. That gap is sitting somewhere in your client base right now.
Most MSPs treat that gap as an awkward subject. Something adjacent to their job, a little outside their lane, a conversation easier to leave alone. That instinct is understandable, and it is also backwards. The under-covered part of your book is not a problem to work around. It is the most valuable conversation you are not having.
Why the gap gets avoided
At face-value, the avoidance makes sense. Insurance feels like someone else’s product. Bringing it up feels like selling something you are not licensed to sell. The conversation itself can feel heavy, so it slips down the list behind the ticket queue and the next onboarding.
However, MSPs must step back and look at what the gap actually means. It is real financial exposure sitting on clients whose security you are already responsible for managing. If one of those uninsured clients takes a ransomware hit or a wire fraud loss, the fallout does not stay neatly in their lane. It becomes your emergency, your late nights, and often your blame, whether or not the incident was anything you could have prevented. The gap is already your problem. The only question is whether you engage with it before an incident or while evaluating the aftermath.
It is the same instinct you already trust
Here is the reframe that makes it easy.
You already sell clients tools they do not fully use on day one. You recommend the backup, the EDR, the security training, all because you know the client needs the protection even when they have not asked for it. Closing the insurance and financial protection gap is the same instinct, pointed at the same goal. Protect the client, and strengthen the relationship in the process.
The easiest version of this conversation is not the client who is already covered. It is the one who is not. They are at risk whether they know it or not. You are the person they already trust with this category. You do not have to manufacture a need. You just have to point out the one is already there.
The line you do not cross
This only works if you are clear about what you are and are not doing, so say it plainly to yourself and to the client. You are not becoming an insurance broker. MSPs are not permitted to sell insurance or advise clients on what policy to buy, and you should not try.
What you can do is different and entirely within bounds. You can start the conversation. You can show a client where they actually stand on security posture, which is where any honest insurance discussion should begin. Then, you can connect them to a broker who specializes in this, so the actual insurance decision is made by someone qualified to make it. You are the facilitator who opens the door, never the advisor who walks them through it. Held to that line, the conversation is a service, not a sales pitch.
What makes the gap closeable
Two things turn this from a nice idea into something a client can act on.
Visibility into posture: An insurance conversation that starts with “here is what your security actually looks like right now” is a real conversation. One that starts with a generic warning is not. Being able to show a client their posture, clearly and specifically, is what gives the discussion weight and gives a broker something concrete to work from.
Financial protection as a wrapper around the whole thing: This is where Cork Protect fits. It provides financial coverage toward specific covered incidents, things like ransomware, wire transfer fraud, and SMS phishing scams, including coverage toward a client’s cyber insurance deductible if a covered incident occurs. It is worth being precise here, because overpromising helps no one. The coverage applies to defined incident types, and the deductible benefit only pays off for a client who actually carries a policy. Named accurately, it is a genuine layer of financial resilience you can place on a client’s account regardless of where they land on insurance itself.
Everyone comes out ahead
Play it forward and both kinds of client benefit. The uninsured client goes from fully exposed to carrying real financial protection, and gains a clear-eyed view of whether a policy makes sense for them. The already-insured client gets a sharper picture of their posture and, often, a better-structured relationship with their coverage. Either way, you did not attempt to sell insurance. In both cases, you delivered something valuable, which is exactly the kind of thing that earns the right to a pricing conversation later. Value first. Price second.
If you are on the client side reading this, the takeaway is calmer than the usual cyber insurance noise. Most businesses like yours either skip this entirely or carry it without fully understanding it, so you are not alone either way. The point is not to panic-buy a policy. It is to know where you actually stand, and to have protection in place either way.
The most valuable conversation in your book
The under-covered part of your client base is not a gap to tiptoe around. It is a room full of people who trust you, carry a real exposure, and have not been given a clear, low-pressure way to think about it. Being the one who opens that door, honestly and within your lane, is some of the highest-value work available to you right now.
The gap was never the obstacle. It was the opening.