27% of Uninsured SMEs Believe They Face No Cyber Risk

Insurance News Desk: Around three in ten uninsured small and medium sized firms still dismiss the risk of a cyberattack, according to GlobalData’s 2025 SME Survey. The research found that 27% of respondents without cyber insurance believed they were unlikely to become victims.

Other common reasons for remaining uncovered included difficulty finding a policy that matched their needs and a sense that their existing protections were already sufficient.

These attitudes persist even as cybercriminals increasingly turn their attention to smaller businesses. Generative AI has made it far easier to craft convincing phishing messages and launch attacks at scale, allowing criminals to target thousands of micro firms at once and profit from a higher volume of lower value frauds.

Research from cyber insurer Coalition shows that business email compromise claims rose by about 30% in the second half of 2025 compared with the same period in 2024, with the upward trend continuing into 2026. The increase has hit micro businesses particularly hard, a segment that previously attracted less attention from attackers.

Charlie Hutcherson, senior insurance analyst at GlobalData, noted that many owners of the smallest companies still assume their size makes them unattractive targets. That assumption may once have held, he said, but AI tools have changed the economics of cybercrime by making automated mass attacks cheap and effective. Smaller firms can no longer rely on low visibility for protection.

For insurers the task is to shift these perceptions while simplifying the buying process. Hutcherson suggested that clearer policy language and the inclusion of core covers such as business email compromise and fund transfer fraud within standard commercial packages could help.

Brokers and underwriters also need to explain how attacks actually unfold and the real financial consequences, since many owners only recognise their exposure after suffering a loss. As AI tools become more widely available, the volume of attacks aimed at the smallest businesses is unlikely to ease, leaving those without cover to absorb fraud losses, interruption costs and recovery expenses themselves.

GlobalData’s survey, conducted in the fourth quarter of 2025, covered 2054 businesses with fewer than 250 employees across 14 countries including the UK, the US, China, India, Malaysia and Brazil.