October brings jack-o’-lanterns, haunted houses, and Cybersecurity Awareness Month. This year’s national theme, “Don’t Make It Easy for Them,” fits the season well. The scariest cyberattacks rarely involve a masked mastermind. They succeeded because a password was reused, an invoice looked legitimate, or an employee was rushed. In other words, someone left the door unlocked.
The numbers are frightening. According to the FBI’s 2025 Internet Crime Report, Americans reported nearly $21 billion in cybercrime losses last year, a 26% jump from 2024, and the Internet Crime Complaint Center logged more than one million complaints for the first time. For small and mid-size businesses, a single successful attack can mean lost funds, lost income, and weeks of disruption that linger long after the incident.
At SRA, we believe small and mid-size businesses are the lifeblood of the American economy. That’s why we built our Data Breach Liability & Loss of Income Plan to fill the coverage gaps that traditional cyber insurance often leaves behind, so a cyber incident doesn’t come back to haunt you.
The Threats Lurking in 2026
Business email compromise is the costume that fools the most people. The FBI attributed more than $3 billion in 2025 losses to business email compromise, where criminals dress up as a vendor, executive, or title company to redirect a payment. These schemes don’t require malware. They only require one convincing email and one wire transfer.
AI has given scammers better disguises. For the first time, the FBI tracked AI-related complaints separately: more than 22,000 reports tied to nearly $893 million in losses. Cloned voices, deepfake video calls, and flawless phishing emails have stripped away many of the warning signs employees were trained to look for, like awkward grammar or an unfamiliar tone.
Phishing is still the most common trick. Phishing and spoofing led all complaint categories by volume, with more than 191,000 reports. Most breaches still begin with someone clicking a link, opening an attachment, or handing over credentials.
Coverage gaps are the skeleton in the closet. In 2024, we shared how rising cyber insurance premiums and stricter underwriting requirements were leaving small businesses and credit unions with gaps. That challenge hasn’t gone away. Many commercial policies still exclude or sharply limit social engineering losses, which is exactly where attackers are finding the most success.
Five Ways to Lock the Door on Cyber Criminals This October
You don’t need an enterprise security team (or a string of garlic over the doorway) to keep the most common threats out. A few habits go a long way.
- Verify every payment change by phone. If a vendor, client, or title company emails new wiring instructions, call them at a number you already have on file. Never use the contact information in the email itself.
- Turn on multifactor authentication everywhere. Email, banking, payroll, and accounting platforms should all require a second step to log in. It stops the majority of credential-based attacks.
- Agree on a code word for urgent requests. With voice cloning now widely available, a phone call from “the owner” asking for a same-day transfer isn’t proof. A simple internal verification phrase is.
- Train your team regularly, not once a year. Short, frequent training keeps employees sharp.
- Update or replace outdated technology. Software and devices that no longer receive security patches are an open door. Keep systems current, and have a recovery plan ready in case something gets through.
When Something Goes Bump in the Night
Even well-trained teams get caught. SRA President Dustin Carlson has said it plainly: most businesses should expect to experience a cyberattack at some point in their operations. The question is whether you’ll have the protection in place to weather the storm when it happens.
SRA’s Data Breach Liability & Loss of Income Plan, offered through an 831(b) Plan, is designed to cover the risks that commercial cyber policies often exclude or cap. Coverage includes:
- Ransomware and extortion
- Social engineering, including fraudulent wire transfers
- Consequential damages
- Extended reporting periods
It’s the same kind of risk mitigation tool previously reserved for Fortune 500 Companies, built for small and mid-size businesses. Nearly 90% of SRA clients carry data breach coverage in their 831(b) Plan.
A Real-Life Cyber Horror Story
A Utah real estate firm lost $250,000 when hackers deceived employees into wiring funds to a fraudulent account. Their traditional cyber insurance would not have covered the loss. SRA’s Data Breach Liability Plan did, turning a nightmare into a story with a much happier ending.
Watch On Demand: Don’t Let Cyber Risk Haunt Your Business
Cyber criminals don’t wait for Halloween to start their tricks. In this 34-minute webinar, Steven Allport, Regional Account Executive at SRA, is joined by DJ and Kevin from SpearTip, SRA’s cybersecurity partner, to walk through two real attacks on businesses and what every owner can do before, during, and after an incident.
The first story is a ransomware attack on a Wyoming health system that started with a single phishing email. Surgeries were canceled, patients were diverted, and weak backups stretched recovery to about two months, with roughly $1.5 million in operational losses. The second is a business email compromise at a car dealership, where attackers posed as another dealership to redirect a wire transfer, then talked their way into picking up three vehicles. The total: $170,000 and three cars gone.
In this session, you’ll learn:
- What to do in the first 24 hours after a ransomware attack, from isolating infected computers to preserving evidence and contacting your insurer
- Why phishing-resistant multifactor authentication is the strongest defense against email compromise
- How to verify bank account changes and add monitoring that catches threats early
- How an 831(b) Plan helps your business prepare financially for cyber risks that commercial policies leave uninsured or underinsured
SRA clients also have access to complimentary services from SpearTip, including a dark web scan, a website vulnerability assessment, and an incident response planning workshop.
Free Cybersecurity Support from Our Partner, SpearTip
SRA partners with SpearTip, a cybersecurity firm that helps businesses prevent, detect, and respond to cyberattacks. Their team handles proactive work like penetration testing and tabletop exercises, 24/7 managed security monitoring, and hands-on incident response when an attack hits.
As an SRA client, you have access to a complimentary SpearTip package that includes:
- A 60-minute cybersecurity briefing
- An incident response planning workshop
- An identity threat detection trial
- A dark web scan
- A website vulnerability assessment
To get started, email info@speartip.com and let them know you’re an SRA client.
Don’t Get Spooked: Protect Your Success This October
Cybersecurity Awareness Month is a reminder, not a finish line. Before the trick-or-treaters arrive, take one step: tighten your payment verification process, enroll your team in Wizer, or review whether your current cyber policy actually covers social engineering losses.
If you’re not sure where your coverage gaps are, SRA can help you find them. Our experienced risk managers will walk you through how the Data Breach Liability & Loss of Income Plan fits within an 831(b) Plan, with no impact to day-to-day operations.
Talk to SRA About Your Cyber Risk
In the News
- The AI Risk Management Gap Is Here & Businesses Are About To Feel It (Forbes, August 2026): SRA CEO Van Carlson on why new AI exclusions are following the same path cyber insurance took over the past decade.
- AI, Fraud and Other Hidden Risks Are Leaving Businesses Exposed as Insurance Coverage Gaps Grow (Smartech Daily, September 2026): Van Carlson on social engineering fraud, AI liability, and the growing list of exclusions in commercial policies.
- Taco Bell’s Parent Company Refused to Say 1 Word on Its Earnings Call. Crisis Experts Think They Know Why (Inc., July 2026): SRA President Dustin Carlson weighs in on how a crisis can damage a brand long after the headlines fade.
