Think you’re insured? Why many SMEs only find out they’re not when it’s too late

For busy business owners, insurance can easily slip down the to-do list. Once a policy is in place, many simply leave it untouched, even as the business grows, new equipment is bought and day-to-day risks quietly change.

But failing to revisit cover can have serious consequences if things go wrong.

A laptop is stolen from a van. A customer injures themselves on your premises. A supplier dispute escalates into legal action. Or a phishing email locks you out of your systems for days. Only when you try to claim do you realise that the loss isn’t covered, or that the payout limit is far below what’s actually required.

Research shows this is more widespread than most owners think. The challenge lies in understanding what policies actually cover, and recognising that these limits can shift as a business changes over time.

A widespread protection gap

A recent report from global insurer Hiscox found that nearly three quarters (74%) of small businesses worldwide are underinsured, leaving them unnecessarily exposed to risk. UK-centric research from Public First paints a similar picture: 28% of sole traders say they have no business insurance at all, while many others lack cover for risks that are highly relevant to their operations.

Even among firms that do buy insurance, reviews aren’t always regular. Around a third of small business owners surveyed haven’t checked their policies in the last three years, which means any growth in revenue, staff, product range or distribution during that time could leave them exposed to new or increased risks.

The result is a quiet “protection gap”, where businesses believe they’re covered, but might struggle to claim the full value of a loss.

Why gaps appear

For the vast majority of business owners, the issue isn’t distrust of insurance. In fact, most SMEs say they view it positively and trust insurers to pay out. The challenge is more practical.

Running a small business is time-consuming, and insurance can feel like something you sort once and renew automatically. Policies are often purchased at the start-up stage, and it’s easy to leave them untouched afterwards, under the assumption that the box has already been ticked.

Understanding what each product does can also be difficult. Hiscox found that nearly two-thirds of small business owners couldn’t accurately describe what public liability insurance covers. Confusion is even higher for cyber and professional indemnity policies. Without a clear understanding of what a policy actually covers, gaps in protection can go unnoticed.

Cost plays a role as well, particularly for sole traders and micro-businesses. For many, premiums can feel like an expense to trim rather than an investment in resilience. This can lead people to delay purchasing cover, limit the scope of policies, or avoid reviewing them altogether. Over time, these small savings can create significant gaps in protection that only become apparent when something goes wrong.

When the risks become real

These shortcomings can quickly become costly. The government’s Cyber Security Breaches Survey found that 43% of UK businesses experienced a cyber attack last year, with the average cost of a serious incident exceeding £3,500. For many small firms, that can be equivalent to several weeks’ profit.

Some business types face far higher losses. LLPs, for example, report average losses of nearly £35,000 per incident, while even sole traders and charities lose around £7,000 on average – sums that can represent a substantial share of annual income.

And these figures don’t capture the broader consequences, such as business interruption, lost contracts, or reputational damage. In 2025, the Co-op was forced to shut down parts of its IT system after an attempted hack that ultimately cost the brand £206 million. Similarly, Marks & Spencer temporarily suspended its online operations following a major cyber attack that cost around £136 million. 

While smaller businesses are unlikely to face losses at this scale, such incidents highlight how quickly operational disruption can become expensive, and how critical adequate protection is.

A simple check-up can make a difference

The good news is that closing most protection gaps doesn’t necessarily mean buying dozens of new policies. Often, it starts with a straightforward review.

Setting aside time at least once a year, as well as whenever your business undergoes major changes, can help ensure your insurance reflects how your firm operates today, rather than the circumstances it did when the policy was first purchased.

Key questions to consider include:

• Have any changes in revenue, stock, or equipment affected my insurance needs?

• Have I taken on staff or contractors, and are they properly covered?

• Could my business survive if operations stopped for several weeks due to an accident, illness, or other disruption?

• Do I rely heavily on IT systems or handle sensitive customer data that might require additional protection?

• Have I reviewed my policies recently or sought advice from a broker to make sure I’m adequately protected?

If any of the answers raise doubts, it may be worth updating your policy or exploring alternatives.

At its core, insurance is about buying time and stability when something unexpected happens. For SMEs operating on tight margins, that breathing room can make the difference between recovering and closing the doors for good.