In September 2026, each Portuguese organisation monitored by Check Point Research faced, on average, 3,181 cyberattack attempts per week. That is 61% more than a year earlier and 25% above the European average. For a small business, the question is no longer if will be targeted. It is when, and whether it will have the means to pay for the restoration.

Portugal is above the European and global average

The latest figures place Portugal amongst the European countries facing the highest attack pressure per organisation, virtually on a par with Italy (DNOTICIAS.PT, 8 Oct. 2026, data from Check Point Research).

Country / region	Weekly attacks by organisation (Sept. 2026)
Italy	3.190
Portugal	3.181
World average	2.803
European average	2.545
Spain	2.507
France	1.815

  These figures measure attempts detected by security systems, many of which were blocked. But they illustrate the sheer number of "doors" that attackers test every week. It only takes one to remain open. The nature of the risk has also changed. In 2025, Portugal recorded just 28 publicly reported ransomware attacks, according to Thales (ECO, 18 Feb 2026). The main threat to SMEs lies in day-to-day operations: phishing, credential theft, fake invoices and access credentials sold on the dark web.

"We’re too small to matter": the most costly myth

According to the Hiscox Protection Gap Report, 35% of Portuguese SMEs without cyber insurance believe they are too small to be targeted. In the same study, around 54% of Portuguese SMEs say they have suffered at least one cyberattack in the last year (Jornal Económico, 29 Jan. 2026). Attackers use automated tools that scan thousands of companies at the same time. They do not choose based on size, but on vulnerability. And an SME can act as a gateway to a larger client: in October 2026, an attack on an IT supplier exposed unclassified data from the Portuguese intelligence services. There is also regulatory pressure. The new Legal Framework for Cybersecurity (Decree-Law No. 125/2025, which transposes the NIS2 Directive) has been in force since 3 April 2026 (Forbes Portugal). The organisations concerned must manage the risks in their supply chains; they will therefore require further assurances from their suppliers, including SMEs.

What cyber insurance actually covers

A cyber risk policy is divided into two parts: the company’s own losses and its liability towards third parties.

Coverage	What you pay	An example from an SME
24/7 incident response	IT, forensic and legal experts from the very beginning	The server crashes on a Friday evening
Data and systems recovery	Costs of restoring files, reinstalling and cleaning systems	Restore the customer database from backups
Loss of profit	Lost revenue and additional costs during the shutdown	An online shop goes 5 days without making a sale
Cyber extortion	Process management and negotiation by specialists	The hackers are threatening to leak customer data
Notification and crisis management	Notify the CNPD and data subjects; communication and reputation	Data breach affecting 2,000 customers
Liability for data breaches	Compensation for injured third parties and legal defence	A customer is suing the company for disclosing their data
Network security	Damage caused to third parties by transmitted malware	A virus spreads from your email to a customer’s system
Social engineering fraud (extension)	Transfers made in error, up to a sub-limit	Fake invoice from a "supplier" paid by bank transfer

  Two points are worth noting in the Portuguese market. The redemption payment itself is not covered, as national legislation prohibits such a guarantee (ECOseguros, interview with Innovarisk). Nor do fines, including those under the GDPR, because the rules governing insurance contracts prohibit cover for administrative offences. Legal defence in the proceedings may, however, be included.

What is usually left out

• Acts of war and, in many policies, attacks attributed to states.
• External infrastructure failures, such as power cuts or internet outages not caused by an attack.
• Incidents that occurred before the policy came into force or that were already known at the time the policy was taken out.
• System upgrades: the policy restores the system to its previous state; it does not cover an upgrade.
• Failure to comply with the security measures stated in the questionnaire, such as multi-factor authentication or backups.

How does the insurer assess your company?

The premium depends on the sector, turnover, the strength of IT security, the compensation limit and any additional cover. Insurers are increasingly asking for more detail in the underwriting questionnaire. Multi-factor authentication, tested backups stored separately from the network, up-to-date systems and staff training all affect the price and even the acceptance of the risk. The human factor counts for a great deal. According to Innovarisk, 67% of cyber claims stem from human error, such as clicking on a link in a phishing email.

Before you hire: 6 questions to ask

1. How many days can the company operate without its IT systems?
2. Does the compensation limit cover at least one to two weeks’ downtime, plus recovery and notification costs?
3. What is the waiting period for loss of profits (how many hours of downtime before cover begins)?
4. What thresholds apply to extortion and social engineering fraud?
5. Is the helpline open 24 hours a day and available in Portuguese?
6. Do the answers to the questionnaire reflect the truth? An inaccurate statement may jeopardise your compensation.

Review your policy every year. According to Hiscox, a third of SMEs have not reviewed their insurance for more than three years, and cyber risk changes faster than any other.  

How Exato Seguros can help At Exato Seguros, we analyse your company’s actual exposure, compare policies from various insurers and help you complete the risk questionnaire accurately. If the worst should happen, we’ll be by your side to assist with the claim and follow up on it. Get in touch with us and request a cyber risk assessment for your SME. exatoseguros.pt                                                                                                 Just the right amount.

SOURCES

1. Portugal suffers more than 3,000 cyberattacks a week — DNOTICIAS.PT, 8 Oct. 2026 (data from Check Point Research)

2. Ransomware attacks are set to soar to 52% in 2025. Portugal suffered 28 — ECO, 18 Feb 2026 (Thales report)

3. Three in four SMEs are unprotected, according to Hiscox — Jornal Económico, 29 Jan. 2026

4. Gonçalo Baptista: cyber insurance for SMEs — ECOseguros, 13 Feb 2022

5. The status of NIS2 in Portugal — Forbes Portugal, 2026