The following text field filters the results that follow as you type.
Many small businesses understand that cyber-attacks happen. The problem is that many don't believe they'll happen to them.
Published on 6 October, 2026
New research from Markel found that 39% of SMEs without cyber insurance believe their business faces a low risk of attack. Yet 29% have already experienced a cyber-attack in recent years.
The findings highlight a significant gap between how cyber risk is perceived and the reality businesses face every day.
Why are SMEs underestimating cyber risk?
For many organisations, cyber threats still feel like a problem for larger businesses with extensive systems, bigger customer databases, and dedicated security teams. In fact, 19% of SMEs surveyed said cyber-attacks were more relevant to larger organisations.
Others assume responsibility sits elsewhere. 13% of respondents said they outsource their IT and therefore don't think about cyber risks, while 11% believed their existing insurance arrangements already provided sufficient protection.
The challenge is that cyber criminals don't discriminate based on business size.
Mark Lowther, Head of Technology & Cyber Underwriting at Markel UK, said:
"The businesses most confident they won’t be targeted are often the ones least prepared if they are. Attackers don’t check headcount before they send a phishing email. A supplier payment redirect or a locked-out booking system can stop a five-person firm as much as a five-hundred-person one."
While smaller firms may hold fewer records or operate less complex infrastructure, many still rely heavily on email, cloud-based systems, online payments, and connected suppliers to operate effectively.
The impact goes beyond financial loss
While financial losses often receive the most attention, the impact of a cyber incident can extend far beyond immediate costs.
An attack can disrupt operations, prevent employees from accessing systems, interrupt communications with customers, delay service delivery, and create reputational challenges.
Mark Lowther
Cyber crime is an everyday business risk. An incident can stop a company accessing its systems, communicating with customers, receiving payments, or delivering its services. The challenge for the insurance industry is to make that risk feel real and relevant before a business experiences an attack.
Bridging the perception gap
The research found that perceived lack of risk remains the biggest barrier to cyber insurance uptake among SMEs, ahead of concerns around cost and understanding of cover. 25% of respondents considered cyber cover too expensive, while 24% said they did not know enough about what it offers.
This suggests there is still work to do in helping businesses recognise cyber risk as an everyday operational issue rather than a remote possibility.
As cyber threats continue to evolve, building resilience starts with understanding that no organisation is immune. The businesses that are best prepared are those that assess their exposure before an incident occurs, rather than waiting until after.
Recognising cyber risk is only part of the challenge. Businesses also need practical support to help them prepare for, respond to, and recover from incidents.
Helping businesses prepare, respond, and recover
Our standalone Cyber Insurance solution combines specialist insurance cover with practical support before, during, and after an incident. It's designed for SME and mid-market businesses with turnover of up to £250 million and includes pre-breach risk management tools, breach response support, crisis management services, and wider legal, tax, and regulatory support.
