AXA Cyber Risk: presentation, guarantees and limits in 2026

Common usage observed among policyholders: coverage of direct costs linked to an attack (ransomware, data theft) and assumption of responsibility for crisis management. Joint intervention by technical and legal teams to restore activity and limit the reputational impact. Strong point regularly reported: coordinated handling of intervention costs and crisis communication, reducing the operational burden for structures without a dedicated in-house team.

Contexts of high relevance: mid-sized companies, SMEs with online activities, consultancies handling sensitive data, and digital service providers. Particularly effective offerings for structures exposed to third-party suppliers or linking critical systems to end customers. Higher levels of risk for regulated sectors where data compliance requires rapid, documented responses.

Limits and irritants noted: variable processing times depending on the complexity of the claim, sometimes high deductibles on compensation items, and classic exclusions linked to acts of gross negligence or systems not kept up to date. In addition, it can take a considerable amount of time to obtain proof (security logs, audit reports, etc.) before compensation can be paid. These elements have an impact on the effective recovery time and the amounts reimbursed in certain cases.

Positioning for first-time buyers: moderately complex offering requiring information on the business, IT architecture and security measures in place. Common prerequisites: description of assets covered, assessment of protection measures (firewalls, backups, updates), and incident history. Level of readability of guarantees generally satisfactory, but certain technical clauses require attention when reading the contract.

Elements facilitating underwriting and day-to-day management:

• online quotation or via broker for rapid premium estimates,
• online policyholder space for contract management,
• telephone assistance and 24/7 technical support depending on formula,
• possibility of intervention by partner experts for immediate response,
• standardized contract documentation and downloadable term sheets.

Essential package - from €30/month. This package covers the cost of immediate response (forensic), the cost of notifying those involved, and limited compensation for business interruption. Key benefits: coverage of technical investigation costs, basic legal assistance and communication costs. Profiles concerned: small structures or associations with moderate digital exposure.

Advanced formula - indicative range €60-120/month. Extended coverage including higher indemnity ceiling, longer business interruption coverage, enhanced legal protection and crisis communication assistance. Often includes conditional ransom advance and access to a network of certified experts. Profiles concerned: SMEs, e-commerce and companies handling a significant volume of customer data.

Premium formula - rates on quotation, tailored to individual needs. Comprehensive coverage including preventive audits, proactive assistance (penetration tests), third-party liability guarantees, and high indemnity ceilings. Additional options include extended business interruption, extended reputational protection, and enhanced coverage of regulatory compliance costs. Profiles concerned: ETIs, highly exposed companies, or organizations subject to strict regulatory obligations.

Response and technical investigation guarantee: the main role of the guarantee is to finance the intervention of teams of forensic experts to identify the breach, contain the incident and restore systems. General operation: activation after claim declaration, outsourced forensic mission, and reimbursement of technical costs according to contractual ceiling. Typical items covered:

• forensic analysis and system security,
• restoration of data and services,
• temporary hosting or redeployment costs.

Liability and legal protection coverage: role consisting of covering costs related to third-party claims (customers, partners) and civil liability actions arising from a data breach. How it works: coverage of defense costs, out-of-court settlements, and compensation awarded as a last resort, subject to ceilings. Situations covered: notification to authorities, claims for compensation by third parties, and compliance costs imposed by regulators.

Optional and complementary cover: options designed to meet specific needs, such as ransom advance, preventive security audits, enhanced reputational protection, and coverage for fines subject to legal conditions. These options enable coverage to be tailored to a company's size and risk profile, and are generally available at an additional premium.

Interest of options according to profiles: highly exposed companies or those subject to regulatory obligations may favor the following options:

• periodic audit and penetration testing,
• coverage of compliance costs and fines (when contractually eligible),
• enhanced public relations and crisis communication assistance,
• extension of coverage to third-party providers.