The data, drawn from Nationwide’s Agency Forward cybersecurity survey conducted in July 2026, highlights a widening gap between awareness and preparedness. While 84% of consumers are concerned about criminals using AI to steal identities, and 81% of mid-market business owners worry about potential cyberattacks, most lack the tools to defend themselves. Only 19% of consumers are highly confident they could identify an AI-powered scam. Similarly, just 24% of independent insurance agents estimate that most of their commercial clients have an incident response plan in place. This disparity creates a significant vulnerability in the global economy, where digital infrastructure is increasingly central to operations.
The financial implications of these breaches are becoming more severe. Among mid-market businesses that have suffered an attack, 86% report that the incident impacted or jeopardized their finances, a 19-point increase since 2024. The costs extend beyond direct monetary loss; nearly every victim (94%) reports damage to customer trust. For small businesses, the situation is somewhat different in scale but similar in nature. While only 16% of small business owners report having experienced a cyberattack, those who have were primarily targeted by phishing (45%) and password attacks (33%). However, the financial toll is rising across the board, with 52% of agents reporting an increase in claims related to generative-AI scams or fraud attempts in the past 12 months.
Market forces are responding to this heightened risk through accelerated insurance adoption, particularly in the middle market. Cyber insurance purchase rates among mid-market business owners have surged to 73%, a 34-point jump since 2024. This adoption is driven by a recognition that traditional liability coverage is insufficient against AI-driven threats. In contrast, small business adoption has remained stagnant at 42%. The primary barriers for this segment are knowledge gaps: 29% of uninsured small business owners say they do not know enough about cyber insurance, and 24% did not know it was available. This divergence suggests a bifurcating market where larger firms are purchasing protection while smaller entities remain exposed due to lack of information.
Businesses are no longer satisfied with just a policy; they are demanding active defense and support. The top-ranked offerings small business owners want from insurers include cyber defense preparation programs (85%) and discount offers tied to a track record of better cyber defense (84%). Mid-market owners share these priorities, reflecting a shift in the insurance model from passive compensation to active risk management. Agents are positioned at the center of this transition. With 90% of agents stating that clients view them as a credible source of cybersecurity information, they are becoming trusted advisers rather than mere transaction processors. 89% of agents now regularly recommend cyber insurance to their customers, recognizing the need to guide clients through a complex threat landscape.
However, significant uncertainties remain regarding the efficacy of current defenses. The rapid evolution of AI tools means that static security measures may quickly become obsolete. For consumers, the threat has expanded beyond financial accounts into everyday digital life. 55% express interest in services to help respond to cyberbullying or online harassment, indicating that the economic and social costs of digital insecurity are broadening. Despite this, preparedness lags far behind awareness. Two-thirds of small business owners admit they have not given much thought to what they would do if they fell victim to a cyberattack. This lack of planning leaves businesses vulnerable to prolonged disruptions, which can have cascading effects on supply chains and local economies.
The role of AI in exacerbating these risks is undeniable. 75% of mid-market business owners and 88% of small business owners say they need more information and resources to protect their businesses from AI-enabled cyberattacks. The threat vector is shifting from simple phishing to sophisticated social engineering, where AI-generated emails impersonate executives or create fake videos to bypass trust. For insurers, the challenge is to provide coverage that reflects this new reality, while for businesses, the imperative is to invest in detection and response capabilities before the next wave of attacks arrives. The path forward requires a coordinated effort between technology providers, insurers, and businesses to close the gap between knowing the threat exists and having the capacity to withstand it.
As the 2026 survey makes clear, the time to prepare is before the attack, not after. For the mid-market business owner who has already suffered a 19-point increase in financial jeopardy from cyber incidents, the next step is not just to buy insurance, but to build a resilient incident response plan. The coming months will likely see continued pressure on insurers to develop more dynamic products and on regulators to enforce better cybersecurity standards. The economic cost of inaction is rising, and the window for proactive defense is narrowing as AI capabilities continue to advance.
