Small Business Continue to Be Underserved by Cyber Insurers: CyberCube

Cyber risk analytics firm CyberCube in a report said the cyber insurance market continues to underserve small businesses although these businesses represent a significant share of the global economic output.

“This protection gap presents both an opportunity and a responsibility for brokers and (re)insurers,” said William Altman, director of Cyber Threat Intelligence Services at CyberCube, in a statement. “Brokers play a crucial role in driving adoption among small businesses, helping them recognize the value of cyber coverage. For (re)insurers, expanding to small enterprises not only broadens market reach and enhances portfolio diversification but also strengthens economic resilience.”

CyberCube’s biannual threat briefing shows small businesses (defined as $10 million to $250 million in annual revenue) from around the globe were attacked in 2024 through February 2025 via ransomware, especially. Data shared from Coveware, a cyber extortion incident response firm, indicate companies with 11 to 1,000 employees account for 75% of Coveware’s response cases. Small business often lack the cybersecurity defenses to prevent and mitigate attacks.

Adding to the current grim outlook is the fact hackers are starting to use artificial intelligence to automate some parts of cyberattacks. CyberCube said it does not expect AI to “revolutionize cyberattacks against small businesses,” but the San Francisco-based firm is keeping an eye on how AI’s use might be used help attackers.

“AI could theoretically accelerate the growth of threat actors targeting small business with lower- and mid-value ransoms by making attacks cheaper, more efficient, and more scalable,” CyberCube said.

Of particular note is the education sector, which is a high-risk due to lower investment in cybersecurity and the valuable student and employee information these institutions hold. Half of the student information and learning systems used by small education organization have an exceptionally large data breach and outage risks, CyberCube added. One student information system, could-based PowerSchool, suffered a data breach in January.