中小企业采取行动应对当前及未来网络安全威胁

current and future cybersecurity threats Contents 03Introduction04Executive summary05Key findings06State of attacks09Taking action10Cyber resilience11AI and future threats13Mandatory disclosures14Country comparisons15Cyber security tips for SMEs The Hiscox Cyber Readiness Report is based on researchconducted byWakefield Researchwith 5,750 businesses, wherethe individuals responsible for their organisation’s cyber securitystrategy were interviewed. This means the owner, principalor partner for those companies with fewer than 50 employees,and either the CIO, CISO, or the director/VP of security or ITfor those companies with 50-249 employees. Research was conducted between 29 July and 8 August 2025,using an email invitation and an online survey, and respondentscan be broken down by geography as follows: 1,000 respondentsin the USA, UK, France, Germany and Spain respectively,500 respondents in Ireland and 250 in Portugal. As research data, this represents a cross-section of insuredand uninsured businesses that may or may not have made aninsurance claim following an incident. It is not necessarilyindicative of our own claims experience or that of the widerinsurance industry. Our report also looks at the impact ofAI on small businesses, for whom it canbe both friend and foe. While AI bringsopportunities and new ways to detectand respond to threats, it also introducesnew vulnerabilities – creating blind spotentry points and exposing gaps in datasecurity that hackers can exploit in muchthe same way as they did with cyberten to 15 years ago. With AI increasinglyintegrated into daily business activities,our specialist teams at Hiscox are focusedon defining its risks, establishing cover forit, and creating the necessary knowledgeand training around it to support smallbusiness owners around the world. The rise of digital commerce hascreated tremendous opportunities forsmall businesses, empowering them toinnovate, reach new markets, and play anincreasingly vital role in the global economy.Perhaps most powerful of these recentdevelopments is artificial intelligence(AI), allowing SMEs to deploy tools andresources that would previously havebeen out of reach. Introduction But these opportunities also presentchallenges. As businesses embrace newtechnologies, they must also navigatea landscape where evolving cyber threatscan jeopardise their success in new ways.This ninth edition of the Hiscox CyberReadiness Report is designed to helpsmall- and medium-sized enterprises(SMEs) better understand the risks theyface in our fast-evolving, technologicallydriven world, and the steps they can taketo minimise their exposure to those risks.Having previously built and grown myown small business, it’s something I’mparticularly passionate about. And yet, while the cyber landscapemay be built on shifting sands, the SMEresponse to it is proactive and pragmatic.The vast majority of SMEs (94%) planto increase their cyber security and dataprotection investments over the next12 months. That includes hiring cyberspecialists, updating training programmes,conducting regular vulnerability checks,and reassessing risks across theirsupply chains. Eddie LambGlobal Head of CyberHiscox We spoke to 5,750 business across theUK, USA, France, Germany, Spain, Irelandand Portugal to understand the impactcyber attacks have on their business, andthe most common exposures they face.More than half told us they had experienceda cyber attack in the last 12 months,and a third of those said they had faced aregulatory fine as a result of a data breachthat was substantial enough to impactthe financial health of their business. At Hiscox, we’re proud to standalongside these businesses, offeringnot just insurance, but insight, expertise,and support. Our 20+ years’ experiencein privacy and cyber insurance, and ourwork with more than 80,000 cyberinsurance customers worldwide, meansthat every day we are helping businessesrecover from incidents, strengthen theirdefences, and build long-term resilience. This underscores the importance ofSMEs taking all necessary steps to protectcustomer data, in line with regulatoryrequirements such as the General DataProtection Regulation (GDPR) in Europeor the consumer protection laws enforcedin the US by the Federal TradeCommission (FTC). When it comes to cyber security andbusiness resilience, we cannot affordto rest on our laurels and consider ourwork finished. Instead, we must maintainour collective resolve to overcomecyber crime, and prioritise an ongoingcommitment to cyber risk management. Ransomware attacks remain a particularlypersistent threat for many businesses.The SMEs we spoke to lifted the lid ontheir own ransomware attack experiences,with some paying multiple times in anattempt to safeguard their sensitive databut where paying a ransom is no guaranteeof recovering your data. Three-out-of-fiveSMEs who paid a ransom said theygot some or all of their data back, butfor almost a third of those who paida ransom, the at