Cyber risk moves further up board agenda: Willis

Cyber risk is becoming increasingly embedded in board-level governance, with 70% of organisations now formally integrating it into their enterprise risk frameworks, according to Willis.

The broker’s “Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus” found 65% of boards receive cybersecurity and threat landscape updates at least quarterly.

Cyber attacks and data loss remain among directors’ and officers’ leading concerns, while 60% of respondents said they quantify potential financial losses from a cyber incident either annually or on an ongoing basis.

However, only 55% said they felt well informed about the cyber risks facing their organisation.

Just 46% believed their board was well informed about how effectively cybersecurity spending reduces risk exposure.

Glyn Thoms, global FINEX cyber strategy leader at Willis, said: “Cyber risk is now a core business risk, demanding greater board oversight and accountability.

“Leaders should regularly test their organisation’s preparedness and recovery capabilities to reduce operational disruption and improve their ability to respond and recover when an incident occurs.”

Insurance and resilience

Almost half of respondents, 48%, currently purchase cyber insurance, with a further 19% planning to buy cover within the next two years.

Among insured organisations, 71% purchase standalone cyber cover, while 29% obtain protection through a general or combined policy.

Willis also found 48% of organisations include cyber insurance premiums within their cybersecurity budget, while 52% use a separate budget.

Phishing and social engineering remained the most commonly cited cyber concern at 48%, followed by ransomware at 38%.

Third-party software vulnerabilities and AI misuse were each cited by 31% of respondents, putting both among the top five global concerns.

Preparedness is also becoming a greater focus, with 78% of respondents having a cyber incident response plan and 62% completing a response testing exercise during the previous 12 months.

Some 63% said they felt well prepared to manage an incident effectively.

Thoms said: “Our survey points to a shift in how cyber insurance is viewed. No longer simply a risk transfer solution, it is increasingly recognised as an enabler of resilience.

“Its inclusion within cybersecurity budgets reflects its importance as a governance driver and a mechanism for financial protection, as well as the access it provides to incident response specialists.”