How much does cyber insurance cost? Real prices with verifiable sources

By Kike Gandia · Co-Founder & CEO, OSCP

There is no official cyber insurance tariff in Spain: neither the supervisor nor the industry associations publish prices, and most insurers only give a figure after a questionnaire. The ranges circulating online come from brokers and comparison sites and contradict each other. For this guide we went to the primary source: the pre-quoted tariff that an insurer on the Spanish market publishes on its own website, read line by line, with its date and its conditions. We complete it with market data attributed to whoever publishes it, so you know exactly where each figure comes from.

The short answer: prices from a published tariff

Hiscox publishes on its website pre-quoted application forms for its CyberClear policy for companies with up to €25 million in turnover. These are some of its annual net premiums, by consolidated turnover and limit of indemnity:

Annual turnover	Lowest limit offered	€1,000,000 limit	€3,000,000 limit
Up to €50,000	€159 (€100,000 limit)	€404	€904
€100,001 to €250,000	€234 (€100,000 limit)	€650	€1,032
€500,001 to €1,000,000	€349 (€100,000 limit)	€768	€1,306
€1,000,001 to €2,500,000	€440 (€150,000 limit)	€900	€1,543
€2,500,001 to €5,000,000	€575 (€150,000 limit)	€995	€1,697
€5,000,001 to €10,000,000	€721 (€300,000 limit)	€1,293	€2,005
€10,000,001 to €15,000,000	€958 (€300,000 limit)	€1,495	€2,318
€20,000,001 to €25,000,000	€1,940 (€600,000 limit)	€2,650	€4,107

Three caveats for reading the table. These are net premiums, with taxes added on top. The documents were created in July 2023, and the market has become cheaper since then. And the insurer itself warns that the pre-quoted premium is only valid if the underwriting questions meet its parameters. This is not a recommendation of this insurer: it is one of the few published, verifiable tariffs on the Spanish market.

Why there is no single price

Each insurer sets its premium from a questionnaire. Mapfre, for example, does not publish a price and explains on its website that it depends on the size of the company, its sector, the sensitive data it handles and its level of protection. The Hiscox tariff shows the same thing in numbers: the premium grows with turnover and with the limit bought, and higher-risk companies simply fall outside the tariff.

The pre-quoted form itself excludes from automatic quotation, and sends to manual underwriting, among others, manufacturers, companies using industrial automation systems (ICS, DCS or SCADA), hosting, cloud or managed IT service providers, companies processing sensitive data on more than 500,000 people and, in the €2.5–25 million band, those with more than €5 million in online turnover. It also places sectors such as banking, insurance, gambling, defence or logistics outside its appetite. If your company is in one of those groups, any generic range found online is of little use: your price will come from individual underwriting.

What is paid on top: optional covers

The base premium does not include everything. In the published tariff, three covers are bought separately:

Optional cover	Companies up to €2.5M turnover	Companies from €2.5M to €25M
Business interruption	€51 to €176 a year depending on turnover	32% on top of the base premium
External technology provider	€27 to €94 a year depending on turnover	17% on top of the base premium
Identity impersonation (fraud)	€90, €175 or €250 for sublimits of €15,000, €25,000 or €50,000	€90 to €300 depending on turnover and sublimit

Two fine-print details. The external technology provider cover can only be bought together with business interruption. And impersonation cover, which is what covers CEO fraud, carries its own deductible: €1,000 up to €5 million in turnover and up to €5,000 in the top band.

Deductibles and waiting period

Two policies with the same premium can pay very different amounts because of the deductible and the waiting period. In the published tariff:

General deductible: €0 for companies with up to €1 million in turnover, €500 between €1 and €10 million, and €1,000 to €2,000 above €10 million.
Business interruption waiting period: one day for companies up to €2.5 million, and 10 to 12 hours above that.
Daily business interruption indemnity for companies up to €2.5 million: €150 to €1,500 a day depending on turnover, with the difference payable up to the limit bought.

When comparing offers, these three figures matter as much as the premium.

Which conditions you must meet for that price

The pre-quoted premium is not automatic: it depends on answering "yes" to the underwriting questions. In the published tariff, these are the conditions:

Supported software patched within 30 days: all programs and systems supported by the vendor and updated within 30 days of each update being released.
Backups at least weekly, stored on disconnected, write-once external media, or with certain cloud providers with at least 30 days of retention and multi-factor authentication on the backup console. In the €2.5–25 million band, backups must also be impossible to alter or delete from the source systems.
No relevant incidents: no incident causing more than €1,000 in losses in the last 24 months.
To cover fraud: multi-factor authentication on webmail for 100% of users and dual approval of payments above €10,000, except companies with 25 or fewer employees and a single signatory.

If any answer is "no", the insurer asks for details and the quote stops being automatic. And answering "yes" when it is not true has consequences: under Article 10 of the Spanish Insurance Contract Act, the payout is reduced proportionally or, in case of fraud or gross negligence, the insurer is released from paying.

Taxes: the net premium is not what you pay

Tariffs are published as net premiums. On top of them applies the Insurance Premium Tax, regulated in Article 12 of Law 13/1996, at a rate of 8%. Insurance is not subject to VAT. In practice, a €400 net premium comes to around €432 with the tax, before any surcharges each insurer applies on its invoice.

Where the market stands in 2026

Three pieces of context, each attributed to whoever publishes it:

Data point	Source	What it shows
Cyber insurance premium volume in Spain grew 12% to €190 million	Aon, study on cybersecurity and cyber risk management in Spain (July 2025)	The Spanish market is still small, but growing
Cyber insurance rates in Europe fell 9% in the second quarter of 2026, the same as in the first	Marsh, Europe insurance rates index	A buyer-friendly market after several quarters of decreases
Digitalisation and cyber risks rose to a high level in the supervisor's risk dashboard	EIOPA, insurance risk dashboard (July 2026)	The European supervisor is watching insurers' cyber exposure

Read together: premiums are not rising, but the market still requires specific controls to insure and is keeping a close eye on cyber risk. A company that can prove those controls negotiates from a strong position.

How to pay less without losing cover

The premium depends largely on factors you do not control, such as turnover or sector. But three levers do depend on you:

Genuinely meeting the questionnaire controls: patching within 30 days, isolated and tested backups, multi-factor authentication on email and dual approval of payments. That is what gives access to the pre-quoted premium instead of manual underwriting.
Choosing the limit by your real exposure, not the highest available: in the published tariff, going from a €100,000 to a €3,000,000 limit multiplies the premium by four to six, depending on the turnover band.
Arriving with evidence: a recent vulnerability assessment or penetration test turns your answers into verifiable facts, which is what keeps the cover standing on the day of a claim.

We do not sell insurance. Our role is the technical side: verifying those controls before you declare them and putting you in touch with specialist brokers and insurers we work with.

FAQ

How much does cyber insurance cost for a sole trader?

In the pre-quoted tariff published by Hiscox, which accepts sole traders, the annual net premium for turnover up to €50,000 starts at €159 with a €100,000 limit and reaches €904 with a €3,000,000 limit, excluding taxes and optional covers. The tariff dates from July 2023 and is only valid if its underwriting questions are met.

And for an SMB?

In the same tariff, a company with €500,000 to €1,000,000 in turnover pays between €349 and €1,306 in annual net premium depending on the limit, and one with €1 to €2.5 million, between €440 and €1,543. Business interruption, technology provider outages and fraud are paid on top.

Why are the figures online so different from each other?

Because they mix different limits of indemnity, covers included or not, premiums with and without taxes, different dates and companies from sectors with very different risks. A price without its limit, deductible and covers cannot be compared with another.

Is VAT charged on cyber insurance in Spain?

No. Insurance transactions are exempt from VAT, but they are subject to the Insurance Premium Tax at a rate of 8% of the premium.

Does the price go up if I have already suffered a cyberattack?

It affects the quote. In the published tariff, an incident with more than €1,000 in losses in the last 24 months takes the company out of the pre-quoted premium: the insurer asks for details of the incident and of the corrective measures and assesses the case individually.

Are cyber insurance prices falling?

According to the Marsh index, cyber insurance rates in Europe fell 9% in the second quarter of 2026, the same as in the first. It is a buyer-friendly market, although insurers still require specific controls before insuring.

Sources

Get my company ready to quote cyber insurance