AI phishing puts SMEs in firing line, but many still see no need for cyber cover

Micro enterprises face severe financial exposure to cyber risk due to a dangerous perception gap regarding their actual risk – many small business owners falsely believe they are too insignificant to be targeted.

However, the rise of AI-powered phishing tools now allows cybercriminals to automate and scale attacks easily, making smaller firms highly lucrative targets, says GlobalData.

The research group’s 2025 SME Survey found that 27% respondents without a cyber insurance policy believe they are unlikely to fall victim to a cyberattack. This was followed by not finding a policy that included everything they needed, and believing they were already well protected against cyberattacks.

The findings come as threat actors increasingly shift their focus towards smaller firms. Research from cyber insurer Coalition shows that the frequency of business email compromise claims rose by approximately 30% in the second half of 2025 compared with the same period in 2024, with claims continuing to climb into 2026.

Coalition noted that this increase has fallen disproportionately on micro businesses which attackers have historically bypassed in favour of larger, more valuable targets.

Generative AI is changing this dynamic. AI phishing kits have lowered the cost of creating convincing, automated social engineering lures at scale, allowing criminals to extract smaller, high-volume payouts from businesses that typically lack dedicated security teams or robust authentication controls.

Charlie Hutcherson, senior insurance analyst at GlobalData, comments: “Many micro businesses still assume that their size keeps them off cybercriminals’ radar. That may once have been true, but AI tools have made it cheap and easy to target thousands of small firms at once. Attackers no longer need to single out a valuable target when they can automate the process and rely on volume, meaning a low profile now offers very little protection.”

For insurers, the challenge is as much about perception as it is about product.

“Simplifying policy wordings and bundling core protections such as business email compromise and fund transfer fraud cover into standard commercial packages would help address concerns about incomplete cover,” says Hutcherson.

However, insurers and brokers will also need to show micro businesses how these attacks happen and what they cost, as many owners may not recognise their exposure until an incident occurs.

“As AI tools become more accessible, the volume of attacks aimed at the smallest businesses is unlikely to slow,” Hutcherson says. “Without a shift in how these firms view cyber risk, more of them will end up absorbing fraud losses, business interruption, and recovery costs themselves. Insurers that can make cover simple to buy and pair it with practical support such as help adopting multi-factor authentication, have an opportunity to grow in an underserved part of the SME market.”

The post AI phishing puts SMEs in firing line, but many still see no need for cyber cover appeared first on IT-Online.