Cyber Insurance SME Morocco 2026: Ransomware, Pricing, 4 Insurers

1. 1. Cyber Attacks on Moroccan SMEs: +180% in One Year

The Moroccan cyber landscape hardened in 2025. The annual report from DGSSI (Directorate General for Information Systems Security) records a 180% increase in cyber attacks targeting SMEs compared to 2024, with ransomware as the dominant vector.

+180% in SME cyber attacks in Morocco between 2024 and 2025 (DGSSI)
65% of SME attacks are ransomware (data encryption + ransom demand)
480,000 MAD: average cost of an SME cyber incident in Morocco in 2025
Most targeted sectors: e-commerce, healthcare, finance, digital services
Law 09-08: security obligations + CNDP sanctions in case of leak
Nascent Moroccan cyber insurance market: 4 active insurers in 2026

Moroccan SMEs have become the prime target of cybercriminals in 2025. Unlike larger companies that are better protected, smaller structures accumulate vulnerabilities: no CISO, outdated antivirus, untested backups, no employee awareness. Result: 65% of attacks recorded by DGSSI in 2025 are ransomware, and 480,000 MAD is the average cost per incident.

The legal framework increases pressure on managers. Law 09-08 on personal data protection imposes security obligations, and DGSSI can now sanction breaches. An SME victim of ransomware with customer data leak faces technical costs, CNDP fines, and civil claims from third parties.

Why 2026 is the Turning Point

Until 2024, cyber insurance was virtually nonexistent in Morocco. The simultaneous arrival of 4 major players (Wafa, AXA, AtlantaSanad, Allianz) in 2026 democratizes the product. SMEs can finally transfer cyber risk to an insurer at affordable rates from 8,000 MAD/year.

2. 2. Comparison of 4 SME Cyber Insurers Morocco 2026

Here is the comparative table of the 4 SME cyber insurance contracts available in Morocco in 2026, with prices, limits and main coverage.

Insurer	Contract	Annual Price	Limit	Ransomware	Third Party Liability
Wafa Assurance	Cyber Shield	8,000 - 28,000 MAD	1 - 8M MAD	Yes	Yes
AXA Morocco	Cyber Solutions	10,000 - 35,000 MAD	2 - 10M MAD	Yes	Yes
AtlantaSanad	CyberPro	9,000 - 30,000 MAD	1.5 - 8M MAD	Yes	Yes
Allianz Morocco	CyberRisk	11,000 - 35,000 MAD	2 - 10M MAD	Yes	Yes

The 4 contracts cover the common cyber base: data loss, forensic investigation costs, ransom (with negotiation by dedicated expert), civil liability to injured third parties, and business interruption during IT downtime. Differences play out on maximum limits, deductibles, and assistance services.

How to Read the Prices

The lower range (8,000-11,000 MAD/year) corresponds to micro-businesses under 10M MAD revenue with low exposure. The upper range (28,000-35,000 MAD) targets SMEs of 30-50M MAD revenue in sensitive sectors (e-commerce, healthcare, fintech).

3. 3. Wafa Assurance Cyber Shield

Wafa Assurance, subsidiary of Attijariwafa Bank group, offers Cyber Shield since early 2026. The contract primarily targets SMEs that are clients of the banking group.

Cyber Shield positions itself as the most accessible contract on the market, with a starting premium of 8,000 MAD/year for micro-businesses. Wafa Assurance bets on cross-selling with Attijariwafa Bank: a professional client of the group benefits from a 15% discount on the cyber premium. The preliminary cybersecurity audit is subcontracted to an approved technical partner, at the insured's expense (3,000 to 8,000 MAD depending on size).

Cyber Shield Coverage

Data loss and reconstruction: up to 3M MAD
Forensic investigation costs: up to 500,000 MAD
Ransomware ransom: up to 2M MAD (negotiation included)
Third party liability (customer data leak): up to 5M MAD
Business interruption: up to 90 days compensation
Overall contract limit: 1 to 8M MAD depending on plan

Eligibility Conditions

Mandatory preliminary cybersecurity audit (report less than 6 months old)
Professional antivirus active on 100% of workstations
Daily backups tested and disconnected from network
Strong authentication (2FA) on administrator accounts
Annual documented employee awareness training

4. 4. AXA Morocco Cyber Solutions

AXA Morocco relies on the global expertise of the AXA group, leading cyber insurer in Europe, to offer Cyber Solutions to Moroccan SMEs since January 2026.

Cyber Solutions is the premium contract on the market, with the highest maximum limit (10M MAD) and inclusion of an international crisis cell activatable in less than 2 hours. AXA Morocco pools the technical resources of AXA XL group (global cyber reinsurer): multilingual ransomware negotiators, certified forensic experts, crisis communication.

Cyber Solutions Strengths

24/7 international crisis cell (response < 2h)
AXA XL ransomware negotiator included in all plans
Executive identity theft coverage (CEO fraud)
Ransom limit: up to 3M MAD
Third party liability: up to 7M MAD (highest on market)
Crisis communication assistance (media, customers, CNDP)

AXA Pricing

AXA Morocco segments prices in 3 tiers by revenue: tier 1 (revenue < 10M MAD) at 10,000-15,000 MAD/year, tier 2 (10-30M MAD) at 15,000-25,000 MAD/year, tier 3 (30-50M MAD) at 25,000-35,000 MAD/year. E-commerce and healthcare SMEs face a 20% surcharge.

5. 5. AtlantaSanad CyberPro

AtlantaSanad, born from the merger of Atlanta Assurances and Sanad, launches CyberPro in 2026 with an approach dedicated to industrial and service SMEs.

CyberPro stands out with a sectoral approach: 5 specialized sub-contracts depending on activity (e-commerce, healthcare, B2B services, industry, finance). This segmentation allows fairer pricing and adapted coverage. Price ranges between 9,000 and 30,000 MAD/year, in the market average.

CyberPro Coverage

Data loss and reconstruction: up to 2.5M MAD
Ransomware ransom: up to 2M MAD
Customer notification costs after leak (Law 09-08): 500,000 MAD
Third party liability: up to 5M MAD
Business interruption: up to 120 days
Cyber-extortion: 1.5M MAD

Prevention Service Included

Free annual cyber audit (value 5,000 MAD)
E-learning platform for employee awareness
Quarterly simulated phishing tests
24/7 technical advisory hotline
Law 09-08 compliance updates included

6. 6. Allianz Morocco CyberRisk

Allianz Morocco launches CyberRisk in 2026 leveraging the Allianz Global Corporate & Specialty (AGCS) division, global leader in industrial and cyber risks.

CyberRisk targets the premium segment of Moroccan SMEs (revenue > 20M MAD) with high coverage needs. Price starts higher than competitors (11,000 MAD/year minimum) but natively includes premium services. Maximum limit reaches 10M MAD, on par with AXA.

CyberRisk Particularities

Allianz Incident Response Team: intervention < 4h
Cyber-terrorism coverage included (rare in Morocco)
Reputation damage warranty: 1M MAD
CNDP defense legal fees: 500,000 MAD
IT subcontractor coverage (cloud, SaaS) included
Allianz AGCS reinsurance on claims > 3M MAD

Target Profile

Allianz CyberRisk primarily targets Moroccan SMEs exposed internationally (export, cross-border e-commerce, fintech), structured family groups, and subcontractors of large accounts with contractual cyber insurance obligations. Average price observed in 2026 is 18,000 MAD/year for an e-commerce SME with 25M MAD revenue.

7. 7. Preliminary Cybersecurity Audit: The Essential Condition

None of the 4 insurers underwrites an SME without a preliminary cybersecurity audit. This audit, at the insured's expense, conditions both eligibility and final price.

Audit duration: 3 to 10 days depending on SME size
Audit cost: 3,000 to 25,000 MAD (insured's expense except AtlantaSanad)
Report validity: 6 months maximum
Points checked: antivirus, backups, 2FA, updates, awareness
Mandatory fixes before subscription if critical vulnerabilities
Audit renewal: annual to maintain coverage

The preliminary audit has become standard in the Moroccan market in 2026. It lasts between 3 and 10 days depending on the SME size, and costs from 3,000 MAD (5-workstation micro-business) to 25,000 MAD (50+ workstation SME). The report must be provided to the insurer and be less than 6 months old.

Good news: AtlantaSanad CyberPro now includes the annual audit in the premium, valued at 5,000 MAD. Wafa Assurance grants a 10% discount if the audit is performed by a certified partner. Investing in the audit is not a pure expense: it is an access condition, a premium reduction lever, and a concrete improvement of protection level.

Choosing Your Auditor

Prefer a DGSSI-approved firm or ISO 27001 certified. Avoid uncertified freelancers: their report may be refused by the insurer. Ask the insurer for the list of audit partners to benefit from price discounts and speed up subscription.

8. 8. Concrete Ransomware Cases of Moroccan SMEs 2025

Three anonymized cases illustrate the real financial impact of ransomware on an uninsured vs insured Moroccan SME.

Case 1: Casablanca E-commerce (Uninsured)

Textile e-commerce SME, 18M MAD revenue, 12 employees. Ransomware encrypting customer database and stock in May 2025. Ransom demanded: 800,000 MAD in cryptocurrency. The SME refuses to pay but loses 6 weeks of activity (impossibility to process orders). Total cost: 1,200,000 MAD (business interruption + database reconstruction + expert fees + 200,000 MAD CNDP fine for customer data leak).

Case 2: Rabat Medical Practice (Insured Wafa Cyber Shield)

Practice of 8 practitioners, 14M MAD revenue. Ransomware encrypting patient files in September 2025. Annual premium paid: 12,000 MAD. Activation of the Wafa crisis cell in 24h, ransom negotiation reduced to 150,000 MAD (paid by insurer), data restoration via healthy backups, CNDP notification managed by insurer. Net cost for practice: 12,000 MAD (annual premium only). Savings: > 900,000 MAD.

Case 3: Casablanca Fintech (Insured AXA Cyber Solutions)

Fintech 25 employees, 35M MAD revenue. Targeted attack with exfiltration of 50,000 customer files in November 2025. Annual premium paid: 32,000 MAD. AXA activates the Crisis Management Team, manages communication to clients and CNDP, covers legal fees (1.8M MAD), compensates business interruption (1.2M MAD) and third party liability (2.5M MAD). Total compensated: 5.5M MAD. The fintech survived where it would have gone bankrupt without insurance.

The Cost/Benefit Ratio

An annual premium of 12,000 to 32,000 MAD covers a potential risk of 500,000 to 5,000,000 MAD. The ROI of cyber insurance is one of the best in the Moroccan professional insurance market in 2026, comparable to medical professional liability.

9. FAQ

Q.Is cyber insurance mandatory in Morocco in 2026?

No, cyber insurance is not mandatory in Morocco in 2026. However, some principals (banks, large accounts, public IT contracts) require it contractually from their subcontractors. Law 09-08 imposes security obligations whose non-compliance can result in CNDP sanctions, which pushes more and more SMEs to voluntarily insure.

Q.How much does cyber insurance cost for a 20-employee SME in Morocco?

For a 20-employee SME with 15-25M MAD revenue, the average 2026 price ranges between 12,000 and 22,000 MAD/year depending on sector and chosen coverage level. E-commerce, healthcare and fintech sectors face a 15-25% surcharge. The preliminary audit (separate) costs 5,000 to 12,000 MAD.

Q.Do the 4 insurers really cover ransom payment?

Yes, the 4 contracts (Wafa Cyber Shield, AXA Cyber Solutions, AtlantaSanad CyberPro, Allianz CyberRisk) cover ransom payment, with limits between 1.5M and 3M MAD. All include a professional negotiator who reduces the requested amount by 50-80% on average. Payment remains a last resort when restoration via backups is impossible.

Q.What happens if I haven't done the cybersecurity audit?

Without preliminary audit, none of the 4 insurers underwrites. It's an absolute eligibility condition in 2026. If you subscribe declaring a higher security level than reality, the insurer can refuse compensation during a claim for false declaration (article 12 of the Moroccan insurance contract). Honest auditing protects your coverage.

Q.Does cyber insurance cover CNDP sanctions in case of data leak?

Partially. Contracts cover legal defense fees before CNDP (up to 500,000 MAD at Allianz), customer notification costs, and third party liability. However, administrative fines pronounced by CNDP are not insurable under Moroccan law: it's prohibited by the insurance code. You remain personally responsible for fines.

Q.What is the best SME cyber insurance contract in Morocco 2026?

There is no best contract in absolute terms, the choice depends on the SME profile. For tight budget micro-business: Wafa Cyber Shield (8,000 MAD/year). For healthcare or e-commerce SME: AtlantaSanad CyberPro (sectoral services). For internationally exposed SME or with big stakes: AXA Cyber Solutions or Allianz CyberRisk (10M MAD limits). Compare with an independent broker to optimize.

Q.How long does it take to subscribe cyber insurance?

Total duration is 4 to 8 weeks: 2-4 weeks to perform the cybersecurity audit, 1-2 weeks to fix critical vulnerabilities identified, then 1-2 weeks for file processing by the insurer. Anticipate 2 months before the desired effective date, especially if you must justify cyber insurance in a tender.

Q.My SME is too small (3 employees), am I eligible?

Yes, the 4 insurers accept micro-businesses from 1 employee, subject to preliminary audit. Wafa Cyber Shield and AtlantaSanad CyberPro have dedicated micro-business plans from 8,000-9,000 MAD/year with reduced limits (1 to 2M MAD). Audit cost for a 3-workstation micro-business is around 3,000-5,000 MAD.

Q.What does the cyber business interruption coverage cover?

Cyber business interruption compensates the revenue drop caused by IT shutdown following a cyber attack. Moroccan contracts cover between 60 and 120 days of compensation (AtlantaSanad CyberPro 120 days, Wafa Cyber Shield 90 days). Calculation is based on average gross margin of the 12 months preceding the claim, after a deductible of 24 to 72 hours.

Q.Can I combine cyber insurance and multi-risk professional insurance?

Yes, and it's even recommended. Professional multi-risk (MRP) covers damage to physical assets (fire, water damage, theft). Cyber insurance covers intangible assets (data, systems, reputation). The two are complementary without redundancy. Subscribing both with the same insurer often allows obtaining 10-15% discount on the overall package.

Protect Your SME from Cyber Risks

Compare for free the 4 SME cyber insurances on the Moroccan market in 2 minutes. Get personalized quotes from Wafa, AXA, AtlantaSanad and Allianz based on your revenue, sector and exposure level.

Compare SME Cyber Insurance

Related guides

13 min read

Self-employed RC Pro insurance Morocco 2026: rates, obligation and comparison