AI-accelerated attacks make cyber insurance increasingly important for small businesses

AI-accelerated attacks make cyber insurance increasingly important for small businesses

Small businesses are meaningfully shifting toward proactive cyber disaster preparedness as part of their business continuity strategies. Between the acceleration of AI and the rising costs associated with cyberattacks, businesses have more reason to prioritize preparation for cyber threats as part of their broader risk-management strategy, Thimble reports.

Cyber threats cost the average American small businesses an average of $1 million in 2026, depending not only on the attack type and severity of the attack, but also the preparedness of the business.

Sixty-nine percent of businesses mistakenly believed they were well-prepared to survive a cyber threat, yet only 60% of small businesses that experience a cyber incident costing under $100,000 actually survived post-incident. While having plans in place to prevent a cyber threat can seem like a costly expense, recovering from attacks can be costly, too. And yet only 17% of small businesses in the U.S. have cyber insurance vs. 62% in the U.K., despite knowing they are prime targets.

Prime targets: 43% of all cyberattacks target small businesses

What are the common cyber vulnerabilities and exposures for small businesses to consider?

According to IBM, there are over 300,000 AI chatbot credentials observed for sale on the dark web right now. That means your small business’s website or app’s chatbot could be infiltrated by a bad actor. There are many ways your business is exposed to cyber threats, and those ways are exponentially multiplying daily.

Consider this list of ways that small businesses can be targeted:

• Weak passwords
• Outdated software that is missing security updates
• Human errors and judgment calls
• Third-party vendors
• Cloud misconfigurations or improper IT architecture and security
• Ransomware, malware, viruses, and spyware

Big fears, small budget: 47% of small businesses say they have zero cyber budget

How to start a proactive plan for cyber threat mitigation for a small business that doesn’t break your bank now or later

The goal is to proactively prepare for cyber threats to mitigate financial disaster, not cause a financial disaster by creating too many expenses. There are many low-cost, high-impact ways to treat cyber threat prevention as a priority without putting a strain on operating costs. The more robust your plan and preparedness, the more likely your business is to survive (and thrive) post-attack.

Core priorities to consider:

• Enable multi-factor authentication for all systems of access, like email, financial accounts, and all admin logins.
• Create and maintain regular backups that are disconnected from your main network.
• Leverage automatic updates and patches for software and core applications.
• Educate employees to avoid social attacks, such as phishing, and to avoid sharing sensitive information with free tools like this one.
• Encrypt all business data and devices to keep information unreadable in the event of a breach.
• Browse no-cost cyber hygiene services for your IT team that include various resources for small businesses, like creating an incident response plan.
• Purchase cyber insurance, with adequate coverage for your business, as well as incident response coordination (which helps provide legal counsel to advise on the proper handling of the incident and defense counsel for third-party claims)

With more and more cyber incidents in the news, it’s no surprise that 69% of U.S. companies reported an increase in cyber attacks in 2025. What might be surprising is that 41% of all incidents reported were AI-driven. Keeping up with threats is getting harder and harder with the acceleration of AI. Avoid being one of the small businesses that believed they were prepared for a cyber incident, or worse, one that didn’t survive an attack. It’s time to create a plan and keep it updated for business resiliency.

This story was produced by Thimble and reviewed and distributed by Stacker.