Hackers, known for going after large organizations to steal data, now have an eye toward easy pickings in smaller companies, according to Markel’s IT and data-privacy underwriting expert.

Jake Kouns, Markel’s senior director of technology, left his job in IT to join Markel six years ago and is determined to rid businesses of the “it-can’t-happen-to-me” attitude toward insurance for data breaches.

“The risk is real, and it doesn’t matter what the size of your organization is,” he said at the National Association of Professional Surplus Lines Offices convention, held in San Diego Oct. 10-12.

Although the thefts of records at large corporations such as Sony have garnered headlines, hackers are finding it simpler going after small-to-midsize companies—a business segment which Kouns says he wants to educate and insure.

The tragedy, Kouns says, is that small-to-midsize businesses can find it very difficult to recover from a data breach without the right insurance, given all the notification and other costs associated with a breach.

Kouns says it is his perspective as an IT security professional that drives his desire to create “real insurance” for data-breach risk. He contends that much of the coverage currently provided doesn’t protect much.

 “It’s the new, sexy insurance. There are 30 carriers now writing it,” Kouns says. Some carriers are providing what he terms “chop-shop” insurance—multiple exclusions included—and he doubts there is actually much coverage to these policies.

The result is a developing market that can be a “saving grace or a moral hazard,” he observes.

“Right now you can get a policy with a $1 million limit for $1,500 in premium,” Kouns says. “That is worrisome. It’s too cheap. Companies will buy the coverage and think they don’t need to do anything to secure their systems.”

Kouns says work needs to be done with companies before Markel will underwrite the risk. The company also provides consulting and risk-management services. “We want to improve security across the board because many of these businesses do not have a clue about this risk or what to do about it,” Kouns says.

Other companies are identifying this growing specialty-insurance market trend: The Hartford has expanded its cyber-risk coverage to include data-breach coverage designed for small businesses.