{"id":14830,"date":"2026-11-04T09:00:11","date_gmt":"2026-11-04T09:00:11","guid":{"rendered":"https:\/\/exatoseguros.pt\/?p=14830"},"modified":"2026-10-29T10:46:51","modified_gmt":"2026-10-29T10:46:51","slug":"cyber-risk-in-smes-what-cyber-insurance-actually-covers-in-practice","status":"publish","type":"post","link":"https:\/\/exatoseguros.pt\/en\/ciber-risco-nas-pme-o-que-um-seguro-cyber-cobre-na-pratica\/","title":{"rendered":"Cyber risk in SMEs: what cyber insurance actually covers"},"content":{"rendered":"

In September 2026, each Portuguese organisation monitored by Check Point Research faced, on average, 3,181 cyberattack attempts per week. That is 61% more than a year earlier and 25% above the European average. For a small business, the question is no longer if<\/em> will be targeted. It is when<\/em>, and whether it will have the means to pay for the restoration.<\/p>\n

Portugal is above the European and global average<\/h2>\n

The latest figures place Portugal amongst the European countries facing the highest attack pressure per organisation, virtually on a par with Italy (DNOTICIAS.PT, 8 Oct. 2026, data from Check Point Research<\/a>).<\/p>\n\n\n\n\n\n\n\n\n\n\n
Country \/ region<\/strong><\/td>\nWeekly attacks by organisation (Sept. 2026)<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Italy<\/td>\n3.190<\/td>\n<\/tr>\n
Portugal<\/strong><\/td>\n3.181<\/strong><\/td>\n<\/tr>\n
World average<\/td>\n2.803<\/td>\n<\/tr>\n
European average<\/td>\n2.545<\/td>\n<\/tr>\n
Spain<\/td>\n2.507<\/td>\n<\/tr>\n
France<\/td>\n1.815<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Estes valores medem tentativas detetadas pelos sistemas de seguran\u00e7a, muitas delas bloqueadas. Mas mostram o volume de “portas” que os atacantes testam todas as semanas. Basta uma ficar aberta.<\/p>\n

O risco tamb\u00e9m mudou de forma. Em 2025, Portugal registou apenas 28 ataques de ransomware divulgados publicamente, segundo a Thales (ECO, 18 Feb 2026<\/a>). The main threat to SMEs lies in day-to-day operations: phishing, credential theft, fake invoices and access credentials sold on the dark web.<\/p>\n

“Somos demasiado pequenos para interessar”: o mito mais caro<\/h2>\n

According to the Hiscox Protection Gap Report, 35% of Portuguese SMEs without cyber insurance believe they are too small to be targeted. In the same study, around 54% of Portuguese SMEs say they have suffered at least one cyberattack in the last year (Jornal Econ\u00f3mico, 29 Jan. 2026<\/a>).<\/p>\n

Os atacantes usam ferramentas autom\u00e1ticas que varrem milhares de empresas ao mesmo tempo. N\u00e3o escolhem pela dimens\u00e3o, escolhem pela vulnerabilidade. E uma PME pode ser a porta de entrada para um cliente maior: em outubro de 2026, um ataque a um fornecedor inform\u00e1tico exp\u00f4s dados n\u00e3o classificados dos servi\u00e7os de informa\u00e7\u00f5es portugueses.<\/p>\n

H\u00e1 ainda a press\u00e3o regulat\u00f3ria. O novo Regime Jur\u00eddico da Ciberseguran\u00e7a (Decreto-Lei n.\u00ba 125\/2025, que transp\u00f5e a Diretiva NIS2) est\u00e1 em vigor desde 3 de abril de 2026 (Forbes Portugal<\/a>). The organisations concerned must manage the risks in their supply chains; they will therefore require further assurances from their suppliers, including SMEs.<\/p>\n

What cyber insurance actually covers<\/h2>\n

A cyber risk policy is divided into two parts: the company\u2019s own losses and its liability towards third parties.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Coverage<\/strong><\/td>\nWhat you pay<\/strong><\/td>\nAn example from an SME<\/strong><\/td>\n<\/tr>\n<\/thead>\n
24\/7 incident response<\/td>\nIT, forensic and legal experts from the very beginning<\/td>\nThe server crashes on a Friday evening<\/td>\n<\/tr>\n
Data and systems recovery<\/td>\nCosts of restoring files, reinstalling and cleaning systems<\/td>\nRestore the customer database from backups<\/td>\n<\/tr>\n
Loss of profit<\/td>\nLost revenue and additional costs during the shutdown<\/td>\nAn online shop goes 5 days without making a sale<\/td>\n<\/tr>\n
Cyber extortion<\/td>\nProcess management and negotiation by specialists<\/td>\nThe hackers are threatening to leak customer data<\/td>\n<\/tr>\n
Notification and crisis management<\/td>\nNotify the CNPD and data subjects; communication and reputation<\/td>\nData breach affecting 2,000 customers<\/td>\n<\/tr>\n
Liability for data breaches<\/td>\nCompensation for injured third parties and legal defence<\/td>\nA customer is suing the company for disclosing their data<\/td>\n<\/tr>\n
Network security<\/td>\nDamage caused to third parties by transmitted malware<\/td>\nA virus spreads from your email to a customer\u2019s system<\/td>\n<\/tr>\n
Social engineering fraud (extension)<\/td>\nTransfers made in error, up to a sub-limit<\/td>\nFatura falsa de um “fornecedor” paga por transfer\u00eancia<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Two points are worth noting in the Portuguese market. The redemption payment itself is not covered, as national legislation prohibits such a guarantee (ECOseguros, interview with Innovarisk<\/a>). Nor do fines, including those under the GDPR, because the rules governing insurance contracts prohibit cover for administrative offences. Legal defence in the proceedings may, however, be included.<\/p>\n

What is usually left out<\/h2>\n