SMEs face cyber cover gap after 34.7% suffer attacks

Only 16.8% of small businesses worldwide hold standalone cyber insurance.

More than one in three small and medium-sized enterprises (SMEs) worldwide have experienced a cyberattack in the past three years, but fewer than one in five have standalone cyber insurance, leaving many businesses exposed to financial losses.

GlobalData's 2025 SME Survey found that 34.7% of SMEs globally had suffered a cyber incident during the period. 

Despite the growing threat, only 16.8% of SMEs worldwide said they had a standalone cyber insurance policy. 

GlobalData said some businesses may have limited cyber cover through other insurance policies, but the low take-up of dedicated cover suggests many SMEs remain underinsured.

Beatriz Benito, lead insurance analyst at GlobalData, said many smaller businesses may not fully understand the value of cyber insurance and are therefore choosing to go without cover.

She said SMEs are generally more vulnerable to cyberattacks because they often lack the technical defences of larger companies, making them more attractive targets for hackers.

Benito warned that whilst large companies may be able to absorb the financial impact of a cyberattack, a major incident could threaten the survival of a smaller business if it does not have adequate insurance.

She added that high premiums have also limited uptake, as insurers continue to price policies cautiously due to changing cyber risks and limited claims data. 

To improve access, insurers need to make cyber cover more affordable by using continuous risk monitoring and encouraging businesses to adopt better cyber security practices.

The findings are based on GlobalData's 2025 SME Survey of 2,054 businesses across 14 markets, including Brazil, China, France, Germany, India, Italy, Malaysia, Mexico, Saudi Arabia, South Africa, Spain, the UAE, the UK and the US.