Small Hotels Face 40% Cyber Gap as Demand Outpaces Systems

The Big Picture

According to Booking.com's European Accommodation Barometer 2026, 94% of large properties feel prepared for a cyberattack, against 60% of operations with fewer than ten staff. This means four in ten small hotels run a digital business they cannot defend.

This week's thesis: demand is there, and the industry's plumbing keeps failing to catch it.

The same Booking.com report, based on 1,240 accommodation leaders, shows the split widening. According to Booking.com, 72% of chains expect positive development, against 55% of independents. Half of respondents report occupancy growth, while the share reporting ADR growth slipped from 43% to 40%. This means rooms are filling through price cuts. 72% of operators rely on discounting, and that does not build margin.

Brief of the Week

Flyr spent about four years pushing airline pricing into hotels, and this week it handed its hotel unit to Duetto, one of the two rivals Skift had said it needed to beat. After HotStats, that is another RMS consolidation. For independents it means fewer vendors and more lock-in, so the useful question is less which system prices best and more what you can take with you when you leave.

The Number

$1,900

According to Hospitality Net, inaccurate hotel content costs travellers $1,900 on average. This means bad data now hurts guests directly, and AI agents will read that data before any human does.

01

Madrid had 350,000 fans and empty rooms

According to Hospitality Net, Madrid's Formula 1 debut drew 350,000 fans, yet local hotels reached only about 70% occupancy. This means close to a third of inventory sat unsold while demand walked the streets. The causes were old habits: wholesale allotments, late cut-offs and rigid rate floors that locked rooms away from the people who wanted them.

02

Travellers use AI to dream, then book elsewhere

According to a Eurostars Hotel Company survey of more than 2,000 travellers, reported by Hosteltur, 71% use ChatGPT, Gemini, Copilot or Perplexity to plan trips. Fewer than 10% would let AI handle most of the organisation. This means AI owns discovery, and the booking still goes to a channel the traveller trusts. Hosteltur also reports that clients now walk into small agencies, such as BidTravel in Asturias, carrying AI itineraries. The agent's job shifts from planning to checking whether the plan actually works.

03

Google's booking protocol forgot the travel agent

According to Hospitality Net, Google's Universal Commerce Protocol for AI hotel bookings has no fields for travel agents, commissions or group terms. Skift's coverage of its Data + AI Summit in Europe describes a "prove-it" phase. AI is changing distribution and operations, but nobody can yet show its effect on booking volume. Agentic booking is being built for a solo traveller with a credit card, and most of the industry's revenue does not work that way.

04

Duetto absorbs Flyr's hotel pricing unit

According to Skift, Duetto is acquiring Flyr Hospitality, ending Flyr's four-year attempt to bring airline-style pricing into hotels. Hotel revenue management is consolidating. Madrid shows why that matters: the software was never the bottleneck, the practices around it were.

Contrarian Take

Every conference this autumn will tell you to optimise for AEO and GEO so ChatGPT recommends your property. Look at it from the traveller's side. She asks the AI, gets inspired, then checks a channel she trusts. There she finds the wrong amenities, no availability because your rooms sit in an allotment, or a site taken down by ransomware. The AI did its job. You lost the booking anyway.

My position: for an independent hotel this winter, fixing content accuracy, distribution rules and basic cybersecurity is worth more than any AI visibility project. That will be unpopular on stage. It is what the data shows.

Where This Goes

TTG Travel Experience opens in Rimini on Wednesday, and you will hear plenty about AI agents. Before you walk in, do three things. Compare your property content across your top three channels. Check every allotment cut-off for next year's events. Then ask who restores your PMS if it gets locked tomorrow morning. If nobody has an answer, start there.