Six in ten businesses report employees use AI for work. Only one in three have written AI policies or responsible-use training. Thirty-five percent of small and mid-market owners believe employees use unauthorized AI chatbots. Twenty-seven percent have rules on what data can be entered into AI tools. Twenty percent have designated teams overseeing AI use. Average cyber claim severity for large US businesses doubled to $4.4 million in 2025. Nearly one-third of businesses were targeted by generative-AI scams in the past year. Eighty-one percent of mid-market owners feel prepared for cyber risk. Only sixty-three percent of small business owners feel the same. Ninety-five percent of mid-market businesses provide annual cybersecurity training. Seventy-two percent of small businesses do. Seventy-three percent of mid-market businesses have cyber insurance. Forty-two percent of small businesses do.

• 6 in 10 businesses use AI for work
• 1 in 3 have written AI policies or training
• 35% believe employees use unauthorized AI chatbots
• 27% have rules on data entered into AI tools