Cyberattacks Are Growing Threat to SMEs – but Insurance Protection Is Low: GlobalData

Cyberattacks are becoming an increasingly significant threat to small and medium enterprises (SMEs), yet insurance adoption remains disproportionately low, according to GlobalData, the London-based data and analytics company.

Limited awareness of cyber risks, affordability challenges, and evolving threat landscapes continue to leave many SMEs financially exposed, said GlobalData, reporting on the findings of its 2025 survey of 2,054 SMEs across 14 countries.

Nearly 35% (34.7%) of global SMEs had experienced a cyber incident in the past three years, GlobalData found in the survey of 2,054 SMEs across 14 countries. Germany’s SMEs are the most vulnerable to cyberattacks in Europe, with 40.3% reporting they had experienced incidents over the same time period.

Despite these findings, cyber insurance is often viewed as an unnecessary product, with just 16.8% of global SMEs stating they have a standalone policy in place, GlobalData said.

While some SMEs may be protected against cyber risks as part of another insurance policy, low penetration rates are alarming, indicating that most SMEs could be underinsured.

While some SMEs may be protected against cyber risks as part of another insurance policy, “low penetration rates are alarming” — indicating that most SMEs could be underinsured, GlobalData said.

“Low cyber insurance rates among SMEs suggest that many smaller businesses are still overlooking cover—possibly because they do not understand the value of such policies,” commented Beatriz Benito, lead insurance analyst, GlobalData, in a statement.

Smaller businesses are less likely to have the same level of technical defense as larger enterprises, making them more vulnerable, GlobalData explained

“Hackers will naturally view SMEs as easier targets. A sizable cyberattack will have a massive financial impact on a large corporation, but on a smaller, less resilient business, an unexpected cash drain can cause immediate insolvency if they are not protected by an adequate cyber insurance policy,” Benito added.

“Cyber insurance is characterized by high premium base lines to ensure profit margins, as providers grapple with ever-evolving risks and limited data,” she said. “As a result, many smaller businesses have been priced out, unable to afford cyber cover. To bridge this gap, insurers must make cover accessible for small businesses through continuous risk monitoring and promoting good digital practices.”

Methodology

GlobalData’s 2025 SME Survey was carried out via an online panel, with 2,054 SMEs surveyed across Brazil, China, France, Germany, India, Italy, Malaysia, Mexico, the Kingdom of Saudi Arabia, South Africa, Spain, the United Arab Emirates (UAE), the UK, and the US.

Source: GlobalData