The main reason micro enterprises do not have a cyber insurance policy is that they believe they are unlikely to fall victim to a cyberattack, a GlobalData survey has found. However, research from cyber insurer Coalition suggests that AI phishing kits are making micro businesses increasingly worth attacking.
GlobalData’s 2025 SME Survey found that the main reason micro enterprises globally do not have a cyber insurance policy is that they believe they are unlikely to fall victim to a cyberattack (27%). This was followed by not finding a policy that included everything they needed and believing they are well protected against cyberattacks. This highlights a persistent perception gap among these businesses, which mistake a low profile for immunity. With threat actors increasingly deploying automated tools to launch opportunistic attacks at scale, this false sense of security leaves SMEs acutely exposed.
Go deeper with GlobalData
Access deeper industry intelligence
Experience unmatched clarity with a single platform that combines unique data, AI, and human expertise.
Meanwhile, research from cyber insurer Coalition shows that AI-powered phishing kits are rapidly shifting threat actor economics toward smaller firms. In a recent risk intelligence briefing, the insurer reported that business email compromise claims frequency surged approximately 30% in the second half of 2025 compared with H2 2024, with claims continuing to climb into 2026. Coalition noted that this surge has fallen disproportionately on micro businesses—targets attackers historically bypassed due to being less valuable than larger companies. Yet generative AI tools have lowered the operational costs of crafting convincing, automated social engineering lures at scale—thus enabling threat actors to extract smaller, high-volume payouts with minimal friction from organisations that typically lack dedicated security teams or robust authentication controls.
To bridge the gap between risk perception and actual threat exposure, insurers must rethink how they design and distribute coverage for micro businesses. Carriers cannot rely on traditional commercial underwriting frameworks that treat cyber insurance as a complex standalone line requiring heavy technical diligence. Instead, insurers need to simplify policy wordings to resolve concerns around incomplete coverage by stripping out confusing exclusions and bundling core protections (such as fund transfer fraud and business email compromise) directly into standard commercial packages.
