Cyber attacks and data loss drive greater board-level focus on cyber risk, says Willis
Key Highlights
- ➤70% of organisations formally integrate cyber risk into board-level enterprise risk frameworks
- ➤65% of boards receive cybersecurity and threat landscape updates at least quarterly
- ➤48% of respondents have cyber insurance, with 19% planning purchases within two years
- ➤Phishing and social engineering lead global cyber concerns at 48%; ransomware follows at 38%
- ➤62% completed cyber incident response testing in the previous 12 months
Expert Statements
Glyn Thoms, Global FINEX cyber strategy leader at Willis
“Cyber risk is now a core business risk, demanding greater board oversight and accountability. Leaders should regularly test their organisation’s preparedness and recovery capabilities to reduce operational disruption and improve their ability to respond and recover when an incident occurs.”
Glyn Thoms, Global FINEX cyber strategy leader at Willis
“Our survey points to a shift in how cyber insurance is viewed. No longer simply a risk transfer solution, it is increasingly recognised as an enabler of resilience. Its inclusion within cybersecurity budgets reflects its importance as a governance driver and a mechanism for financial protection, as well as the access it provides to incident response specialists. To maximise these benefits, policies should be reviewed regularly as cyber risks continue to evolve.”
LONDON, Oct. 21, 2026 (GLOBE NEWSWIRE) -- Seven in ten organisations (70%) now formally integrate cyber risk into their board-level enterprise risk framework, while 65% of boards receive cybersecurity and threat landscape updates at least quarterly, according to the latest Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus from Willis, a WTW business (NASDAQ: WTW). With cyber attacks and data loss remaining among directors’ and officers’ leading concerns, the findings show cyber risk is firmly established as a board-level business issue, driving greater board and CEO engagement in cyber governance.
This year, respondents were asked for the first time how regularly they quantify potential financial losses from a cyber incident. Sixty per cent said they do so either annually (19%) or on an ongoing basis (41%). However, only 55% feel well informed about the cyber risks facing their organisation, and just 46% believe their board is well informed about how effectively cybersecurity spending reduces risk exposure.
Get started
Create a free account to read the full story.