Written by Jean-Georges NANOT, May 13, 2026
Table of contents
- The cyber risk landscape for French operations of foreign groups
- The seven coverages of a modern French cyber policy
- French-specific underwriting requirements in 2026
- Coordination with your global cyber program
- Conclusion: French cyber risk has French specificities
- Real-world case: ransomware at a French subsidiary, 92% recovery
- Frequently asked questions
Introduction
According to the ANSSI (French national cybersecurity agency) Panorama de la cybermenace 2025, more than 4,500 significant cyber incidents were handled in France over the year, with nearly 40% targeting mid-cap and SME-size companies including subsidiaries of foreign-headquartered groups. The IBM Cost of a Data Breach 2024 report estimates the average cost of a cyber loss in France at EUR 4.17M, up 12% compared to 2023. For a French subsidiary, a major incident now represents 5-25% of EBITDA.
For foreign HQs operating in France, cyber insurance requires specific French structuring beyond extension of the global cyber policy. French regulatory environment (CNIL, NIS 2 transposition, RGPD enforcement, sector regulators like ACPR for finance and HDS for healthcare), French claims handling specificities, and integration with the French subsidiary’s operations create requirements that a generic global policy often does not cover adequately. CBE Consulting advises foreign-headquartered groups on cyber insurance structuring for their French operations.
1. The cyber risk landscape for French operations of foreign groups
Threat panorama 2026
Four threat families dominate the cyber landscape for French operations in 2026:
- Ransomware: remains the first threat in volume and impact. Groups operate in ransomware-as-a-service mode with systematic double extortion (data encryption + threat of disclosure)
- Targeted phishing and social engineering: still the most frequent entry vectors (~70% of compromises per ANSSI). Techniques refined with generative AI: highly credible false emails, voice deepfakes for CEO fraud, supplier impersonation
- Supply chain attacks: compromising an IT provider then propagating to clients. SolarWinds 2020, Kaseya 2021, MOVEit 2023 demonstrated the scale. For a French subsidiary, the risk is also indirect: a Tier 1 or Tier 2 supplier attacked can paralyze operations
- Industrial systems attacks: OT, SCADA, industrial IoT. Cyber-physical convergence makes industrial sites vulnerable
French-specific consequences
A cyber incident affecting a French subsidiary triggers French-specific consequences in addition to standard cyber recovery:
- CNIL enforcement: GDPR fines up to 4% of worldwide revenue, frequent investigations
- NIS 2 obligations: notification of incidents within 24 hours for entities in scope (industrial, financial, healthcare, transport)
- ACPR enforcement for financial sector subsidiaries: specific cyber resilience requirements
- Claims under French law: collective and individual actions by affected persons, particularly aggressive plaintiff bar in France
These specificities require French legal expertise that a generic global cyber program does not always include.
Average cost by subsidiary size
Order of magnitude for French subsidiaries in 2026 based on IBM, ANSSI, Hiscox data:
| French subsidiary size | Average total cost | Range |
|---|---|---|
| Small (revenue < EUR 5M) | EUR 60K | EUR 20-180K |
| SME (revenue 5-50M) | EUR 230K | EUR 80-600K |
| Mid-cap (revenue 50-500M) | EUR 1.8M | EUR 600K-5M |
| Large operations (revenue > 500M) | EUR 7M | EUR 3-25M |
These figures include direct and business interruption costs. They exclude ransom paid (rare in 2026 in France) and long-term reputation damages.
2. The seven coverages of a modern French cyber policy
Forensic and investigation costs
First triggered coverage: prise en charge of investigation costs by a forensic team. Major actors in France: Mandiant, Kivu, Arete, Crowdstrike, Wavestone, NTT Security. Typical cost: EUR 50-250K for a mid-cap French subsidiary.
IT system and data restoration
Replacement of compromised hardware, clean reinstallation of servers, backup restoration, post-incident security audit. Typical cost for a mid-cap French operation: EUR 100-400K. This coverage generally includes increased cost of working during reconstruction.
Business interruption losses
The most important loss type in modern cyber incidents. Indemnification of revenue loss during operational shutdown, on a negotiated indemnification period (typically 6-12 months maximum). Time deductible (waiting period) usually 8-12 hours before activation.
Cyber extortion and ransom payment
Modern policies generally include a cyber extortion coverage. Three strict conditions apply:
- Coverage explicit in the contract (sometimes optional)
- Payment validated by insurer and its agreed negotiator
- OFAC sanctions clause: if attacker on sanctions list, payment illegal and not covered
Since 2024, French government strongly recommends not paying. Policy then covers reconstruction costs without ransom.
Third-party liability and GDPR costs
When a cyber incident affects personal data or contractual data of clients/partners, third-party liability exposes the French entity. The policy covers:
- Legal fees: specialized digital law attorneys (in France: Cabinet Reed Smith, Bird & Bird, DLA Piper, Hogan Lovells, etc.)
- Notification costs: registered letters, dedicated platforms
- Damages to third parties: compensation paid to affected persons
- CNIL administrative sanctions: up to 4% of global revenue for serious GDPR violations, subject to policy provisions
Crisis communication costs
A cyber attack generates reputation risk. The “crisis communication” coverage covers fees of specialized agencies (Image 7, Brunswick, FleishmanHillard, Havas Paris). Typical cost: EUR 30-100K for a mid-cap French operation.
Defense and regulatory procedures
Final key coverage: costs to defend the French entity in regulatory procedures following an incident. ANSSI investigations, CNIL inquiries, ACPR controls if regulated, criminal public action if sensitive data leaked. These costs can reach several hundred thousand euros on complex cases.
3. French-specific underwriting requirements in 2026
The 60-120 question questionnaire and audit preliminary
Since 2023, cyber insurers no longer grant coverage on simple declaration. Standard subscription process includes:
- Detailed questionnaire of 60-120 questions on IT organization, dispositions in place, claims history, employee training
- For French operations above EUR 50M revenue, a light cyber audit by a preventionist commissioned by the insurer or the independent broker
- Review of IT service agreements with external providers (hosting, IT outsourcing, SOC)
The questionnaire commits the company: any inaccurate declaration can void the contract in case of claim (Article L. 113-8 of the French Code des assurances). A questionnaire pre-review by an independent broker has become critical.
Minimum 2026 technical requirements
French cyber insurers require a minimum cybersecurity floor:
- Generalized MFA on remote and privileged access
- EDR (Endpoint Detection and Response) or next-generation antivirus on all workstations
- Immutable backups (offline or isolated cloud)
- Documented incident response plan tested annually
- Annual phishing training with exercises
- Privileged account management (PAM, password vault)
- Documented patch management
Without this floor, insurers refuse or require dissuasive deductibles and exclusions.
Standard exclusions in French policies
Exclusions to verify line by line in French cyber policies:
- War exclusion: since Merck v. ACE (2022) and Mondelez (2023) cases, state-attributed attacks frequently excluded. Demand restrictive war exclusion drafting
- OFAC sanctions: universal
- Gross and systemic negligence: non-application of critical patches known for several months, total absence of MFA
- Pre-subscription incidents: any non-declared incident before subscription is excluded
- Cyber extortion on third-party infrastructure: if ransomware hits your cloud host rather than your systems directly, some policies exclude
- Physical damages: if cyber incident caused material damages, coverage may shift to PD policy
Free assessment of your French cyber coverage
Does your French subsidiary have cyber coverage subscribed more than 18 months ago, or rely solely on the global cyber program? CBE Consulting offers a free assessment of your coverage. 30 minutes by video, no commitment.
Request an assessment → · +33 9 80 43 16 34 · secretariat@cbeconsulting.fr
4. Coordination with your global cyber program
Common gaps in extended global cyber programs
Three frequent gaps observed in foreign HQ global cyber programs that affect French subsidiaries:
- GDPR-specific coverage: global programs from non-EU HQs sometimes have insufficient GDPR-specific sub-limits
- French-language incident response: global insurer’s response team may not have French-language forensic and PR capabilities for fast deployment
- French claims jurisdiction: claims arising from French operations may not be enforceable under the global non-admitted policy
When a dedicated French cyber policy makes sense
For French subsidiaries with revenue > EUR 30M and meaningful exposure (e-commerce, financial services, healthcare, regulated industries), a dedicated French cyber policy is generally recommended. This French policy:
- Sits alongside the global cyber program (not replacing it)
- Provides French-issued admitted coverage with proper GDPR specifics
- Includes French-language incident response and forensic team
- Coordinates with global policy via DIC/DIL clauses
Annual renewal coordination
The cyber market evolves faster than any other insurance market. Three best management practices:
- Renew annually with a light bidding process (3 insurers minimum). The market has broadened since 2023: Hiscox, AIG, Allianz Global Corporate, AXA XL, Chubb, Beazley, Hannover Re intervene on the French market
- Review limits annually based on French subsidiary evolution: revenue growth, geographic expansion, SI dependency, automated processes
- Audit exclusions at each renewal: insurers frequently slip new exclusions into amendments
5. Conclusion: French cyber risk has French specificities
Cyber insurance for French operations cannot be approached as a simple extension of the global program. French regulatory environment (CNIL, NIS 2, RGPD, ACPR), French-specific legal action exposure, and French operational needs create requirements that benefit from a dedicated or properly coordinated French policy. For foreign HQs with meaningful French operations, the structuring effort delivers both better protection and clearer claims handling.
To engage a personalized assessment, contact CBE Consulting via the contact page.
6. Real-world case: ransomware at a French subsidiary, 92% recovery
Context: French subsidiary of a US distribution group (subsidiary revenue EUR 140M, 320 employees, 4 logistics warehouses, central ERP). Cyber policy subscribed 2 months before attack: limit EUR 2M, deductible EUR 50K, cyber extortion coverage included.
Detection and declaration (May 2024): * Monday 6:00 AM: IT discovers ERP encrypted * Monday 9:00 AM: declaration to cyber insurer via 24/7 hotline * Monday 12:00 PM: Mandiant forensic team on site
Forensic investigation (days 1-5): * Entry vector: targeted phishing on accountant 6 days earlier * Privilege escalation in 4 days, ransomware deployment on day 5 * Data exfiltration: 220 GB (customers, financial, HR) * Identified group: Black Basta (not OFAC-sanctioned, payment legally possible)
Ransom demand: EUR 1.8M in Bitcoin, decryption promised within 24h after payment.
Friday (day 5) decision: * Immutable backups intact (verified by forensic): reconstruction possible * Data exfiltration: disclosure risk maintained even if payment * French government position: do not pay recommendation * Decision: do not pay, reconstruct from backups
Reconstruction (days 5-17): * Days 6-10: critical server reconstruction * Days 11-14: progressive ERP restoration in degraded mode * Days 15-17: complete operations resumption
Final costs: * Forensic: EUR 85K * IT reconstruction (external team + internal hours): EUR 240K * Crisis communication: EUR 45K * Business interruption during 17 days of partial shutdown: EUR 1.2M * GDPR legal fees and CNIL notifications (4,200 affected persons): EUR 35K * Total loss: EUR 1.605M
Insurance indemnification: * Policy limit EUR 2M ✓ * Deductible EUR 50K * Forensic sub-limit EUR 200K ✓ * Communication sub-limit EUR 50K ✓ * Final indemnification: EUR 1.48M (92% of loss covered) * Remaining at charge: EUR 125K
Lesson: declaration speed (3 hours after detection) and immutable backup quality (set up 6 months earlier on cyber audit recommendation) enabled avoiding ransom payment. Without cyber policy, this loss would have hit EBITDA by EUR 1.6M, about 11% of 2023 EBITDA.
Case profile from ANSSI Panorama de la cybermenace 2024, Mandiant M-Trends 2024, IBM Cost of a Data Breach 2024 reports.
Have CBE Consulting assess your French cyber coverage
Our consultants offer:
- A free assessment of your current cyber policy (limits, exclusions, sub-limits)
- A benchmark of your premium and conditions vs. 2026 French market
- A costed optimization or restructuring recommendation
No commitment, by video, 30 minutes.
Phone: +33 9 80 43 16 34 Email: secretariat@cbeconsulting.fr
7. Frequently asked questions
Does my global cyber program cover my French subsidiary properly? Often partially. Common gaps for foreign HQs: GDPR-specific sub-limits insufficient, no French-language forensic team for fast deployment, claims enforcement issues under French law, CNIL-specific defense costs. For meaningful French operations, a dedicated French cyber policy coordinated with the global program is recommended.
How much does cyber insurance cost in France for a mid-cap subsidiary? Orders of magnitude 2026 for mid-cap French operations: EUR 25,000-80,000 annual premium for EUR 5-10M limit. Premium varies by risk profile, sector, cyber security disposition quality, claims history. A French subsidiary mature in cybersecurity (generalized MFA, EDR, immutable backups, annual training) obtains 25-40% better conditions than one without dispositions.
What does a French cyber policy cover? Modern French cyber policy covers seven dimensions: 1) investigation and forensic costs, 2) IT and data reconstruction, 3) business interruption during shutdown, 4) cyber extortion and ransom payment (under sub-limits and OFAC subject), 5) GDPR legal fees and CNIL notifications, 6) third-party civil liability, 7) crisis communication costs. Verify sub-limits, waiting period, and exclusions.
Will the policy pay the ransom in case of ransomware? Yes, under three strict conditions. The contract must include cyber extortion coverage (sometimes optional). Payment must be validated by insurer and its agreed negotiator. The OFAC sanctions clause applies: if attacker on sanctions list, payment is illegal and not covered. Since 2024, several French insurers and the French government strongly recommend not paying. Policy then covers reconstruction costs without ransom.
What is NIS 2 and how does it affect cyber coverage? NIS 2 (Directive UE 2022/2555) is a European cybersecurity directive transposed into French law in 2024. It imposes on a broad perimeter of “essential” and “important” entities reinforced cybersecurity obligations and incident notification within 24 hours. For affected sectors (industrial, financial, healthcare, transport, energy, etc.), the directive’s obligations are subscription conditions for French cyber policies. Verify your scope.
What’s the difference between a French cyber policy and our existing global one? A dedicated French cyber policy: French-language incident response, French-issued admitted coverage with proper GDPR specifics, claims under French law, sub-limits adapted to French exposure, CNIL-specific defense. A global cyber program: cross-border coordination, group-level limits, central management. Both can coexist (French policy plus global excess via DIC/DIL clauses) for optimal coverage.
About the author: Jean-Georges NANOT
Jean-Georges NANOT is consulting broker and founder of CBE Consulting, an insurance broking firm based in France specialized in international risk management. He advises French ETIs with international activity and foreign-headquartered subsidiaries in France on insurance program structuring, risk audits, and claims management.
ORIAS no. 15000172 LinkedIn: [to be completed] View all articles by this author
About this article
This article was written by Jean-Georges NANOT to provide expert insight on the topic discussed. The information presented is of a general nature and does not replace a personalized audit. Each situation requires specific analysis of your risk exposure. For an assessment adapted to your company, contact our team.
CBE Consulting, Cap de Bonne-Espérance Consulting, insurance broker. ORIAS no. 15000172 Supervisory authority: ACPR, 4 place de Budapest, 75009 Paris, France.
Sources and references
- ANSSI, Panorama de la cybermenace 2024 and 2025
- Cybermalveillance.gouv.fr
- IBM Cost of a Data Breach Report 2024
- ENISA Threat Landscape 2024
- Mandiant M-Trends 2024
- CNIL, GDPR recommendations
- NIS 2 Directive (EU) 2022/2555
- DORA Regulation (EU) 2022/2554
- French Code des assurances Article L. 113-8
- ACPR
Featured Industries
Become an Expert!
Get the latest insights from our newsletter.
Free 31 page Blueprint For Consultants
Complex situation, changing demands and dynamic market environment make today's business even more challenging.