AI Phishing Surge Threatens Micro Businesses as Cyber Insurance Gap Widens

Micro-enterprises are facing increased financial exposure as AI-driven automation allows cybercriminals to target smaller firms at scale. Despite a 30% rise in business email compromise claims, a significant portion of small business owners remain uninsured, falsely believing their size provides anonymity. This disconnect presents a critical challenge for brokers and underwriters attempting to close the protection gap.

What was announced

GlobalData’s 2025 SME Survey has identified a dangerous perception gap among micro-enterprises regarding their actual cyber risk. The findings reveal that 27% of respondents who do not currently hold a cyber insurance policy believe they are unlikely to fall victim to an attack. Other primary reasons for remaining uninsured include the inability to find a policy that covers all necessary risks and a misplaced belief that existing security measures are already sufficient.

This lack of coverage coincides with a sharp increase in targeted activity. Research from cyber insurer Coalition indicates that the frequency of business email compromise (BEC) claims rose by approximately 30% in the second half of 2025 compared to the same period in 2024. This upward trend has continued into 2026, with micro-businesses bearing a disproportionate share of the impact. Historically, threat actors bypassed smaller firms in favor of larger targets, but generative AI has fundamentally changed the economics of cybercrime.

AI-powered phishing kits have significantly lowered the cost and effort required to create convincing social engineering lures. This allows criminals to automate attacks at scale, extracting high volumes of smaller payouts from businesses that often lack dedicated security teams or robust authentication controls. For the insurance industry, the challenge lies in simplifying policy wordings and bundling core protections—such as BEC and fund transfer fraud cover—into standard commercial packages to address concerns about incomplete coverage.

"Many micro businesses still assume that their size keeps them off cybercriminals’ radar. That may once have been true, but AI tools have made it cheap and easy to target thousands of small firms at once. Attackers no longer need to single out a valuable target when they can automate the process and rely on volume, meaning a low profile now offers very little protection."

Charlie Hutcherson, Senior Insurance Analyst at GlobalData

The companies involved

GlobalData is a leading intelligence and productivity platform providing data-driven insights across various global industries, including the insurance and insurtech sectors. The company was previously known as Progressive Digital Media Group Plc before undergoing a significant rebranding and name change on January 1, 2016. Since then, it has established itself as a key source of market intelligence for carriers, brokers, and reinsurers looking to understand shifting risk landscapes and consumer sentiment.

By tracking SME trends and claims data, GlobalData helps insurance professionals identify emerging protection gaps, such as the current discrepancy between micro-enterprise cyber risk and insurance uptake. The organization’s research frequently highlights how technological shifts, particularly the rise of generative AI and automated threat tools, alter traditional underwriting assumptions. In the current market, GlobalData serves as a bridge between raw data and actionable strategy for insurance executives navigating the complexities of digital transformation and evolving threat vectors in the commercial lines space.

What FF News has reported before

FF News and Insurtech Eye have extensively tracked how AI and digital shifts are reshaping the insurance landscape. We previously looked at how Underwriting Leads as Insurers Accelerate Enterprise-Wide AI Adoption, highlighting the internal operational shifts within carriers. The competitive landscape for intermediaries was also explored in our report on how AI Overtakes Comparison Sites as Top Threat to UK Commercial Insurance Brokers. Furthermore, the specific vulnerabilities of certain industries were detailed in our coverage of how the UK Property Sector Faces Dangerous Cyber Insurance Gap as Attacks Surge 17%. We also noted broader financial services trends in European Banks Risk Losing 75% of Customers Over AI and Personalization Gaps, which underscores the rising expectations for digital-first protection and personalized risk management.

What this means from an insurtech perspective

This announcement highlights a critical failure in the current distribution model for cyber insurance. For carriers and MGAs, the micro-enterprise segment has often been neglected due to low premiums and high acquisition costs, but the industrialization of phishing via AI makes this a high-volume risk pool that can no longer be ignored. The pressure is now on brokers to move beyond simple policy placement and act as risk consultants who can demonstrate the tangible cost of business interruption to skeptical owners. Success in this sector will likely depend on product innovation—specifically the bundling of cyber cover into standard commercial packages—and the integration of proactive security tools like multi-factor authentication into the policy lifecycle to lower loss ratios and build customer trust.