Cyber Insurance Gap Leaves SME's Exposed To Cyber Attacks

Cyberattacks are becoming an increasingly significant threat to small and medium enterprises (SMEs), yet insurance adoption remains disproportionately low. Limited awareness of cyber risks, affordability challenges, and evolving threat landscapes continue to leave many SMEs financially exposed. As cyber incidents grow in severity and sophistication, closing the protection gap has become a pressing priority for insurers, says GlobalData, a leading intelligence and productivity platform.

According to GlobalData’s 2025 SME Survey, 34.7% of global SMEs had experienced a cyber incident in the past three years. In Europe, German SMEs are the most vulnerable to cyberattacks, with this figure rising to 40.3%. Yet cyber insurance is often viewed as an unnecessary product, with just 16.8% of global SMEs stating they have a standalone policy in place.

While some SMEs may be protected against cyber risks as part of another insurance policy, low penetration rates are alarming, signalling that most SMEs could be underinsured.

Beatriz Benito, Lead Insurance Analyst, GlobalData, comments: “Low cyber insurance rates among SMEs suggest that many smaller businesses are still overlooking cover—possibly because they do not understand the value of such policies.”

Smaller businesses are less likely to have the same level of technical defence as larger enterprises, making them more vulnerable.

Benito concludes: “Hackers will naturally view SMEs as easier targets. A sizable cyberattack will have a massive financial impact on a large corporation, but on a smaller, less resilient business, an unexpected cash drain can cause immediate insolvency if they are not protected by an adequate cyber insurance policy."

“Cyber insurance is characterized by high premium base lines to ensure profit margins, as providers grapple with ever-evolving risks and limited data. As a result, many smaller businesses have been priced out, unable to afford cyber cover."

"To bridge this gap, insurers must make cover accessible for small businesses through continuous risk monitoring and promoting good digital practices.”