As attacks intensify, cyber insurance uptake declines.
That is the paradox highlighted by the latest edition of Hiscox’s report on cyber risk management. While cyberattacks are becoming more industrialized, the uptake of a cyber policy by French micro, small and medium enterprises (SMEs) is retreating, falling from 33.6% to 27.6% in one year.
More broadly, the share of French SMEs with no cyber coverage of any kind rose from 39% to 45% over the same period. Result: only 55% of French companies report today that they have cyber coverage, and 12% of them say they have none and do not intend to obtain one, versus one in eleven (9%) in 2025.
France is not an isolated case: the trend affects most of the markets studied.
Portugal records the steepest drop, down 26 points in a year, followed by Spain and Ireland, each down 9 points.
But not all companies react to the threat in the same way. In the United States and the United Kingdom, which maintain the highest coverage rates, the decline in dedicated uptake does not reflect a retreat in overall coverage but a shift: nearly one in two (50%) now opts for a global multi-risk policy, integrating cyber into a single contract rather than a dedicated policy.
Another indicator worth noting: the budget. French SMEs allocate on average €29,700 per year to their cyber resilience, two to three times less than their Spanish, Italian, or British counterparts.
But the picture is not entirely bleak. Among French uninsured SMEs, 33.1% report considering taking out a cyber policy within the next twelve months. This is the highest proportion across all studied countries.
The cost of a cyberattack weighs heavily
Four out of ten French companies (40%) that have suffered an attack report falling victim to financial fraud through payment diversion; this is the most common consequence, far ahead of reputational damage (19.8%), which remains the leaders’ top concern.
A mismatch that is partly explained by the origin of the attacks. 26% of incidents originate from human error, such as an employee targeted by phishing or social engineering, and nearly one in four would involve a contractor or external partner.
Financially, the average estimated impact for a French SME victim of a cyberattack in the past twelve months stands at €45,900 on average across the ten countries studied.
In terms of duration, while 66.8% of incidents end with business interruption of less than a day, the average duration of all incidents reaches 24.5 hours, driven by the more severe cases. A duration still shorter than in Germany or Spain, where 22% and 20% of incidents stretch to 4–7 days respectively.
But the true cost of a cyberattack goes far beyond the accounting ledger.
Virtually all French SMEs affected (96%) acknowledge an impact on their strategy or financial health: growth delays (36%), impact on valuation (33%), postponed technology investments (31%).
And the shockwave also hits the workforce. 37% of employees at attacked companies report high stress, more than a quarter note a deterioration in the work climate (27%), and an increase in sick leaves (25%). A finding already identified in the 2025 edition of the report and which persists.
AI, the next battleground and a blind spot in coverage
The report highlights a growing worry: nearly one French decision-maker in two (49%) identifies data poisoning (an attack aimed at corrupting the training data of an AI model) as the most serious emerging cyber threat over the next five years.
In response to this risk, coverage remains patchy. Only 69% of French insured hold a policy that includes AI-related risks, compared with 74% on average across the other European countries studied. The United States and the United Kingdom have anticipated this evolution more.
*Hiscox Cyber Risk Management Report, 2026 edition.
Study conducted by Wakefield Research, which surveyed 6,800 cybersecurity decision-makers responsible for cybersecurity strategy in organizations with fewer than 250 employees across ten countries (United States, United Kingdom, France, Germany, Spain, Ireland, Portugal, Italy, Netherlands, and Belgium), between June 5 and 17, 2026,
