New BizCover research: Most SMEs don’t think they’re at risk of a cyberattack

An email from a supplier. An invoice waiting to be paid. A request to update bank details. These are all familiar parts of running a business. They can also give scammers an opportunity to slip a fraudulent request into an otherwise ordinary working day. 

New research commissioned by BizCover suggests some small business owners may underestimate that exposure. Among the 545 insured Australian small business owners surveyed, 43% reported at least one suspicious cyber incident or scam attempt in the previous 12 months. Yet 34% believed their business was too small to be likely to attract cybercriminals.  

For business owners, the findings highlight the value of understanding where cyber risks arise, what safeguards are in place and whether their insurance includes cyber cover. 

BizCover General Manager Brad Miller and Chief Information Security Officer Akshaye Kalkura explain what the findings mean for small businesses. 

Key takeaways 

• 43% of respondents reported at least one suspicious cyber incident or scam attempt in the previous 12 months. 
• 34% believed their business was too small to be likely to attract cybercriminals, while 25% thought they did not hold enough valuable data to be an attractive target. 
• 27% received an email impersonating a trusted supplier, bank or government agency, and 18% received a fake invoice or suspicious payment request. 
• 54% said they had no cyber-related insurance cover. 
• Only 16% said they knew they had cyber cover, either through a specific policy or as part of another business insurance policy. 

Cyber threats can show up in everyday work 

The most commonly reported potential threats involved messages that could resemble everyday business requests: 

1. Emails impersonating a trusted supplier, bank or government agency (27%). 
2. Fake invoices or payment requests from an unknown or suspicious sender (18%). 
3. Urgent requests to change payment details from an unknown or suspicious contact (7%). 

Receiving one of these messages does not necessarily mean a business lost money or suffered a successful attack. But it does show how potential threats can pop up in the same inbox used to manage customers, suppliers and payments. 

Akshaye Kalkura says familiar-looking requests can make scams harder to recognise. 

“A message doesn’t have to look unusual to be suspicious. It might look like an invoice you were expecting or an email from someone you deal with regularly. A request to change bank details or make an urgent payment is a reason to pause and check,” Kalkura says.  

Being small does not remove the risk 

Brad Miller says the research highlights a gap between the risks small businesses encounter and how owners perceive their exposure. 

“There is a misconception that cybercrime is a big business problem,” he says. 

Around one in three respondents (34%) believed their business was too small to be likely to be targeted. A quarter (25%) thought they did not hold enough valuable data to attract cybercriminals. 

However, cyber exposure can come from routine activities such as paying suppliers, storing customer details or accessing business accounts online. A business does not need an extensive customer database to have money, information or account access worth protecting. 

“It’s easy to assume your business is too small to interest a cybercriminal, or that your existing business insurance already includes cyber cover. But neither is a safe bet,” Miller says. 

Business owners don’t think a cyberattack could happen to them 

Among those businesses that do not carry cyber insurance, 37% of respondents said they did not think their business was at risk from cyberattacks. This was the most common response. 

Cost was the next most common reason, with 14% saying cyber insurance was too expensive. Another 12% said they relied on other protections, such as antivirus software, backups or IT support. 

Awareness and understanding also played a part: 7% said they did not know cyber insurance existed, while 5% did not understand what it covered. 

A further 4% said they had looked into cyber insurance but decided not to take it out. 

Kalkura says understanding the limits of existing safeguards is an important part of managing cyber risk. 

“It’s important to have cybersecurity measures in place, such as antivirus software and regular data backups,” says Kalkura. “But those measures don’t remove every risk. Understanding what they protect against, where gaps remain and how you would respond to an incident can also help your business prepare.” 

What can happen if a small business is hit by a cyberattack? 

For an owner already juggling customers, cash flow and administration, recovering from an incident can add pressure.  

“For a small business, a successful scam can have significant consequences – there’s loss of time and money, disruption to day-to-day operations, and reputational damage. Those pressures are hard to absorb when you’re already stretched running the business,” says Miller. 

The disruption may also continue after the initial incident has been identified. Regaining access to accounts, checking what information was affected and restoring systems can take time away from serving customers. 

Having business insurance does not automatically mean having cyber cover 

The survey also revealed gaps in cyber insurance ownership and understanding. Only 16% of insured respondents said they knew they had cyber cover. This comprised 8% with a specific cyber policy and 8% with cover included in or added to another business policy. 

The remaining 84% fell into four categories. Across the full sample: 

• 54% said they had no cyber-related cover. 
• 14% were unsure what their current policy covered. 
• 9% assumed their general business insurance covered cyber incidents but had not checked. 
• 7% did not know business insurance could cover cyber incidents. 

These responses tell different stories. Some owners knew they had no cyber cover, while others were unsure or had made assumptions about their policy. 

“Checking your policy wording can help clarify whether cyber cover is included, which events it covers, and what limits or exclusions apply,” says Miller. 

How Cyber Liability insurance can help safeguard your business 

Cyber Liability insurance can help you manage many types of cybercrime (like cyberattacks, ransomware, and data breaches) by covering legal costs, data recovery, fines and penalties, and other expenses related to the cyber event. 

There are also optional extensions available to help cover losses involving social engineering, phishing or cyber fraud. 

If you’re unsure about what your cyber risks may be or what kind of cover may suit your needs, our friendly team can help answer your questions about Cyber Liability insurance. 

Methodology 

An independent consumer research agency on behalf of BizCover conducted an online survey of n=545 Australian small business owners who currently have insurance. The survey was conducted between 1 and 13 of July 2026. Respondents were recruited nationally across all states and territories through an accredited online research access panel. The study was designed to capture the experiences and perspectives of this specialist audience.