Cyberattacks are evolving and employing more sophisticated techniques, making even the largest businesses increasingly vulnerable. However, a substantial proportion of UK businesses remain unprotected against cyberattacks despite the rising frequency of these unforeseen events, as per a survey conducted by GlobalData, a leading data and analytics company.

According to GlobalData’s 2025 UK SME Insurance Survey*, 40.2% of small- and medium-sized enterprises (SMEs) hold cyber insurance. Adoption of cyber insurance rises sharply with business size, ranging from 13.1% among sole traders to 63% among medium-sized enterprises (with 50– 249 employees).

SMEs hold off from purchasing cyber insurance mainly because they consider it unlikely that their business will be a target of a cyberattack (40.5%), while a further 16.4% find insurance unnecessary as they believe their company is already well protected.

Beatriz Benito, Lead Insurance Analyst, GlobalData, comments: “Businesses with no cyber insurance may not necessarily have a safety net to manage the costs and reputational damage associated with a cyberattack if one occurs. Given that these incidents can be particularly costly, some businesses may well end up having to close their operations for good. Cyber insurance policies offer better resilience as they can assist with forensic investigation and data restoration, legal fees, regulatory fines, lost revenue during downtime, and crisis management.”

Recent data from the Association of British Insurers highlights the magnitude of the problem, with cyber insurance claims payouts reaching £197.3 million ($257.8 million) in 2024, more than triple the £59.7 million ($78 million) disbursed in 2023. The average claim paid was over £276,000 ($360,637.45) in 2024—up from under £113,000 ($147,652.29) in 2023.

Benito continues: “Average payouts are likely to go up as there is no sign of abatement. 2025 has been characterized by a string of high-profile attacks, with well-known brands Harrods, Marks & Spencer, and Jaguar Land Rover (JLR) impacted. In fact, JLR was not covered by cyber insurance, signaling that while adoption levels are higher among larger businesses, coverage is still not universal among large corporations.”

Benito concludes: “SMEs are more vulnerable as they are inherently less resilient. Insurers should look to develop more tailored solutions given that many smaller businesses operate on tight margins, often viewing cyber insurance as an unnecessary expenditure.”

*GlobalData’s 2025 UK SME Insurance Survey was carried out via an online panel, with 1,508 businesses surveyed.