An email that looks like it's from a regular supplier, an invoice with an "updated" account number, or a server that wakes up encrypted on a Monday morning. Cyberattacks are no longer an exclusive problem for large corporations; they have become part of the daily reality for small and medium-sized enterprises. The National Cybersecurity Institute (INCIBE) handled 122,223 incidents in 2025, 26% more than the previous year, of which over 55,000 were malware cases and more than 25,000 were phishing. Its helpline, 017, also received 142,767 inquiries.
In this context, Insurvia Bròker, an insurance brokerage registered with the Directorate-General for Insurance and Pension Funds under code F3451 and integrated into the NEWCORRED network, has decided to specialise in a sector that is still a minority in the portfolios of Spanish SMEs: cyber risk insurance. And it is doing so with a clear territorial focus: the business fabric of the northern Horta region and Camp de Túria, grouped under AEMON.
A risk that no longer understands size
Most SMEs still think, "It won't happen to us." However, attackers specifically target organisations with fewer defence resources: workshops, distributors, transport companies, professional practices, or clinics that rely entirely on their ERP, email, and backup systems. A single day with invoicing or logistics halted can result in greater losses than the annual cost of a policy.
In addition to business interruption, other fronts arise: the obligation to notify the Spanish Data Protection Agency of a security breach, potential claims from clients and suppliers whose data has been compromised, and reputational damage. The General Data Protection Regulation (GDPR) stipulates fines of up to 20 million euros or 4% of global turnover, and large companies increasingly require their suppliers to demonstrate cybersecurity measures and insurance coverage as a condition for continued business.
"Companies should not see cyber insurance as just another expense, but as the business continuity plan that allows them to open their doors the day after an attack."
GERSOM REINALS ROSELLÓ, founder of Insurvia Bròker
AEMON, a preferred zone.
The Business Association of Moncada, Alfara, Náquera, and Bétera (AEMON) brings together over 170 associated companies across six business areas —three in Moncada and one in each of the other three municipalities— employing thousands of workers in what is now known as the "Carraixet axis." Insurvia Bròker, a member of the association, has designated this territory as its preferred area of operation for cyber risks.
This focus is driven by proximity. The companies in the industrial estates of Moncada, Alfara del Patriarca, Náquera, and Bétera share a very specific profile: industrial, distribution, and service SMEs, highly digitised in their management but often lacking their own IT department. "We know the territory and its business owners. We want any associated company to have a reference broker just a few kilometres away, who can clearly explain what their policy covers and what it doesn't, and who will be by their side if they suffer an incident," explains Reinals.
The brokerage firm offers companies in the area no-obligation exposure diagnostics, policy comparisons tailored to each activity, and awareness sessions on best practices, with the aim of ensuring that insurance is accompanied by prevention.
What a good cyber policy should cover
Cyber risk insurance is not a homogeneous product, and differences between companies can be significant. Based on the brokerage's experience, here are the points any company should review before signing up:
- 24/7 Incident Response: technical, forensic, and legal team available from the first minute.
- Own Damage: data, system, and equipment recovery after an attack or security failure.
- Loss of Profits: compensation for business interruption and, importantly, the applicable waiting period (hours of delay).
- Third-Party Liability: claims from clients, suppliers, or employees due to data breaches.
- Data Protection: notification costs, defence before the AEPD (Spanish Data Protection Agency), and, where legally permitted, administrative sanctions.
- Extortion and Ransomware: incident management and negotiation and recovery costs.
- CEO Fraud and Supplier Impersonation: often with low sub-limits or excluded; it is advisable to verify this specifically.
- Security Requirements: backups, two-factor authentication, or updates may be a condition of coverage.
The value of independent advice
As a brokerage firm, Insurvia Bròker does not represent a single insurer but works with a panel of specialised cyber risk insurers. This allows it to compare coverages, limits, deductibles, and exclusions and to propose the solution that best suits each company's activity, turnover, and level of digital maturity.
Some of these solutions also include preventive services, such as external vulnerability scanning or phishing simulation campaigns for staff, which reduce the likelihood of an incident occurring. "Insurance must go hand in hand with prevention. Most attacks we see come through an email or a weak password, and this can be addressed with training and simple measures," notes the brokerage's founder.
Prevent, Transfer, Respond
The recipe proposed by specialists for Valencian SMEs can be summarised in three verbs. Prevent, with basic digital hygiene measures and training. Transfer to the insurance market the risks that cannot be eliminated. And respond quickly when an incident occurs, because the first few hours are crucial. In a year when cyberattacks have increased by a quarter, the question for many companies in the Carraixet axis is no longer whether they will suffer an incident, but whether they will be prepared when it happens.
