For years, the smallest businesses had a kind of protection nobody sold them: they were not worth an attacker's time. Coalition's claims data suggests AI is taking that away.
In a new risk intelligence briefing, the cyber insurer reported that business email compromise (BEC) claims frequency rose about 30% in the second half of 2025, compared with the same period a year earlier, and has kept climbing into 2026. The increase has fallen mainly on micro businesses that attackers have historically left alone because they "weren't previously worth the effort".
Coalition believes automated attacks may explain the shift, and considers it likely that attackers are already using AI to run BEC campaigns. The figures come from anonymised claims across Coalition's global portfolio of more than 110,000 policyholders, so they reflect its own book rather than the UK market alone.
The clearest evidence sits in the tooling. Coalition points to EvilTokens, a subscription phishing kit used to compromise more than 12,000 inboxes across more than 10,000 organisations. The kit uses AI to write phishing emails, get around multi-factor authentication, set mailbox rules that hide the intrusion and scan inboxes for sensitive data. Access costs US$1,500 upfront and US$500 a month. Coalition calls it the best example yet of AI changing the cybercrime business model.
At that price, a small target no longer has to be a large payday. Coalition expects BEC claims frequency to rise 60-100% by 2027 as tools that bypass multi-factor authentication spread. It does not expect frequency to more than double, because attackers remain constrained by infrastructure takedowns and the need to recruit money mules. Individual losses stay small: the average BEC claim is typically below US$30,000.
The UK picture points the same way. The government's Cyber Security Breaches Survey 2025/2026 found that 42% of micro businesses reported a breach or attack in the previous 12 months, with phishing the most common type. Insurance has not kept pace. Recent research from Markel UK found 44% of SMEs it surveyed held no cyber cover at all, and nearly four in ten of those uninsured firms believed they faced a low risk of attack.
Coalition says brokers could use the rising risk "to open conversations with non-buyers in the SMB segment".
The more expensive risk sits one step downstream. Funds transfer fraud, where a business is tricked into sending money to criminals, is Coalition's second most common claim type, with an average severity of US$140,000. Its frequency actually fell 18% in 2025. But Coalition expects it to rise 20-50% over the next year as automated BEC tools are extended to spot upcoming payments and draft emails that redirect them. It cited Microsoft research from September 2026 describing AI-fabricated invoices and email threads used to impersonate chief executives at scale.
For now, the overall picture is contained. Coalition's total claims frequency has held between 1.4% and 1.6% since 2022, and it has seen no evidence yet that AI has lifted ransomware frequency.
For brokers with insured SME clients, the exposure to check is the sublimit. Coalition notes that funds transfer losses are covered under both cyber and crime policies, typically up to a sublimit of around US$250,000, and warns that sublimits will not protect insurers if AI scales up the frequency of fraud. The control it recommends is simple: finance teams should call back on a trusted phone number to confirm any change to payment details, backed by dual sign-off.
