España: AIG, Zurich, Beazley, XL y Chubb cubren el riesgo tecnológico

España's AIG, Zurich, Beazley, XL, and Chubb lead the market for technology insurance derived from artificial intelligence, with Allianz and Hiscox among others. These insurers have a vast network of services across various countries, enabling them to serve the needs of Spanish multinationals. Spanish domestic insurers such as Mapfre, Telefónica Seguros, and Occidental also offer coverage for medium-sized businesses, a niche also occupied by subsidiaries of major insurers.

The cyber insurance market in Spain reached around 200 million euros in premiums last year, according to Gonzalo Ayala, responsible for Marsh Risk Spain's technology industry. The market's situation is much calmer than in the U.S., the birthplace of major tech companies. Unlike the situation in 2022, there has been a steady increase in insurers capable of covering this risk in recent years, even traditional insurers in this segment have expanded their capacity. This suggests that overall, sufficient capacity exists to cover this risk, according to Ayala.

For exceptionally large enterprises with an unusually high risk seeking indemnities above the average, going outside Spain to markets like London may be necessary, but this is rare, says Marsh Risk Spain's director. Unlike in the U.S., in Spain, insurance policies do not include exclusions for coverage if the cyber attack used AI, according to Howden Iberia's accounts executive Ignacio Fernández Baert.

Willis shares this view and states that not only is AI not currently excluded, but insurers are even adding supplements to provide coverage for artificial intelligence. This occurs despite the fact that AI usage makes attacks more damaging.

Despite this surge, cyber insurance loss experience is currently at acceptable levels, allowing for profitability for insurers, notes Fernández Baert. This evolution is due to the increasing number of policies purchased, which has diluted loss experience. Before the pandemic, few companies subscribed to this coverage, and there were some billion-dollar losses, which jeopardized the profitability of this activity.

Now, coverage has democratized, with companies with annual revenue below 300 million euros purchasing it. Even so, only 30% of companies take out this coverage, similar to France and Germany. The current market situation allows a company to find cyber risk insurance with coverage up to 15 or 20 million euros, something that was not possible a few years ago when such policies could not be tailored to a company's specific case, whereas now it is possible.

However, a cycle change is being observed; there is a trend towards increased loss experience, mainly due to the increasing frequency of incidents with the growing use of AI. This is not expected to be noticeable in the short term, but more so in a year's time. Spanish companies faced 789 cyber attacks in the first half of 2026, a 45% increase compared to the same period in 2025, according to data from NTT Data.

Allianz Commercial and Zurich are the two insurers with the most visibility in covering data centers in Spain, a business with strong growth prospects. There is great interest among insurers in covering these infrastructures, all of them daily ask for participation in this market, says Willis' senior director Mireya Ortega. What to do after a cyber attack Phase 1: Notification and opening of the claim - Upon learning of a cyber attack or ongoing attack, contact the insurer with key details: an estimated timeline of the incident, initial suspicious type, and critically compromised corporate systems.

It is important not to hire independent IT experts or legal consultants that could alter evidence before notifying the insurance, as this could result in automatic loss of coverage due to contract breach. Phase 2: Technical containment and evidence preservation - This includes isolating the computer network and physically or virtually disconnecting the affected servers from the internet.

Phase 3: Forensic diagnosis and economic mitigation - In addition to the company's own teams, the insurer's designated incident response team must be involved. They analyze logs to determine the exact scope. Finally, the infrastructure is cleaned and disinfected. During this phase, the most valuable economic coverages of the policy are activated: forensic expenses (engineers' fees), data recovery costs, and income suspension coverage (compensation for income not received while the company's activity is completely paralyzed).

Phase 4: Regulatory and legal compliance - The legal nature of the attack is formalized, managed by the insurance company's legal team with communication to the police and the Guardia Civil. This includes a notification of the security breach: if personal data (customers, employees, invoices) has been affected, an report is sent to the Spanish Data Protection Agency (AEPD).