In a context where digital threats can jeopardize business continuity, Spanish companies are adopting increasingly decisive measures to strengthen their security after suffering a cyber incident. Among them, a standout decision that shifts responsibility for cybersecurity directly to top management: 33% of small and midsize businesses (SMBs) tie executive compensation or bonuses to meeting cybersecurity objectives, according to Hiscox’s 2026 Cyber Readiness Report.
At the same time, there is a tightening of internal security policies. Specifically, 30% of SMBs have banned the use of personal devices for work purposes, forcing employees to work exclusively with devices managed by the organization. Likewise, 19% have chosen to restrict remote access or hybrid work arrangements to reduce exposure to potential threats.
Complementing these decisions is a greater reliance on specialized advice. Thus, 28% of SMBs have increased the involvement of external cybersecurity experts to bolster their incident response capabilities, while 25% have rolled out new training programs for employees. Meanwhile, 24% have reviewed and improved the processes for evaluating and selecting new professionals, adding higher security requirements.
The strengthening of controls also extends to information management and crisis preparedness for the future. In this regard, 24% of SMBs have restricted employees’ access to critical business data, while 23% have developed or updated their cyber incident response plans. Taken together, these decisions show that organizations are addressing the consequences of cyberattacks from a broader perspective, combining executive accountability, workforce training, and strengthened internal procedures.
The Adoption of Cyber Insurance
Beyond organizational measures, the evolution of digital-risk insurance contracting adds another relevant element to the analysis of business readiness. According to the report, 58% of SMBs currently hold some form of cyber risk coverage. Specifically, 30% have a standalone cyber insurance policy, while 28% have this protection bundled into another general policy.
However, data also show the existence of short-term hiring plans among those without this protection. In this sense, 17% plan to acquire a standalone policy in the next twelve months, while another 16% plan to add such coverage to their current policies. By contrast, only 10% say they do not have cyber insurance and do not plan to obtain it.
At the same time, the rapid integration of advanced solutions into the business fabric is introducing new protection needs. In this scenario, 76% of SMBs with cyber insurance confirm that their policy explicitly covers cybersecurity risks and incidents related to the use of artificial intelligence. This finding reflects the ongoing inclusion of AI-associated risks in the realm of insurance protection.
Meanwhile, 10% of insured organizations are evaluating or plan to add this type of coverage in the near term. By contrast, 11% acknowledge that their current policy does not expressly cover AI-related risks, while 3% are unsure whether they have this protection.
