As the economy dominated the headlines this week with the UK Budget and the build up to the USA’s Fed December Meeting warnings over the growing threat of cyber-attacks may have gone unnoticed.

There have been warnings cyberattacks are evolving and employing more sophisticated techniques, making even the largest businesses increasingly vulnerable.

Data and analytics company, GlobalData warned a substantial proportion of UK businesses remain unprotected against cyberattacks despite the rising frequency of events.

According to GlobalData’s 2025 UK SME Insurance Survey, 40.2% of small- and medium-sized enterprises (SMEs) hold cyber insurance. Adoption of cyber insurance rises sharply with business size, ranging from 13.1% among sole traders to 63% among medium-sized enterprises (with 50– 249 employees).

It added SMEs hold off from purchasing cyber insurance mainly because they consider it unlikely that their business will be a target of a cyberattack (40.5%), while a further 16.4% find insurance unnecessary as they believe their company is already well protected.

Beatriz Benito, lead Insurance Analyst, GlobalData, examines: “Businesses with no cyber insurance may not necessarily have a safety net to manage the costs and reputational damage associated with a cyberattack if one occurs. Given that these incidents can be particularly costly, some businesses may well end up having to close their operations for good. Cyber insurance policies offer better resilience as they can assist with forensic investigation and data restoration, legal fees, regulatory fines, lost revenue during downtime, and crisis management.”

Benito continued: “Average payouts are likely to go up as there is no sign of abatement. 2025 has been characterized by a string of high-profile attacks, with well-known brands Harrods, Marks & Spencer, and Jaguar Land Rover (JLR) impacted. In fact, JLR was not covered by cyber insurance, signalling that while adoption levels are higher among larger businesses, coverage is still not universal among large corporations.”

Benito concluded: “SMEs are more vulnerable as they are inherently less resilient. Insurers should look to develop more tailored solutions given that many smaller businesses operate on tight margins, often viewing cyber insurance as an unnecessary expenditure.”

What makes the situation worse is the findings of new research from active insurer Coalition added that there is a growing trend by UK businesses to rely on their general commercial insurance products to protect against attacks rather than standalone cover.

Standalone cover comes with a range of benefits most importantly a security checks to identify vulnerabilities before and attack can occur. Should the worst happen, they will also look to how they can manage and mitigate the impact rather than simply pay a sum when the cyber criminals have completed the attack and business are left to pick up the pieces.

The threat is increasing and businesses must understand the need for action and cover.

Jon Guy, Editor,

Emerging Risks