Cyber attacks and data loss drive greater board-level focus on cyber risk, says Willis

Cyber risk is now a board-level priority, but confidence in risk understanding remains low.

What the company is saying

Willis, a WTW business (NASDAQ:WTW), presents its Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus as evidence that cyber risk is now embedded in board-level governance. The company highlights that 70% of organisations formally integrate cyber risk into their enterprise risk frameworks and 65% of boards receive cybersecurity updates at least quarterly. The announcement emphasises the growing adoption of cyber insurance, with 48% already insured and another 19% planning to purchase coverage within two years. Glyn Thoms, global FINEX cyber strategy leader at Willis, frames cyber risk as a core business risk requiring board oversight and regular preparedness testing. The narrative stresses a shift from prevention to resilience, positioning cyber insurance as both a financial protection tool and a governance driver. The company underscores that only 55% of respondents feel well informed about cyber risks and just 46% believe their board understands the impact of cybersecurity spending, indicating persistent knowledge gaps.

What the data suggests

The survey shows that cyber risk management is now mainstream at the board level, with 70% of organisations formally integrating it into their enterprise risk frameworks. 65% of boards receive cybersecurity and threat landscape updates at least quarterly, but only 55% of respondents feel well informed about their organisation’s cyber risks. 46% believe their board is well informed about the effectiveness of cybersecurity spending, highlighting a significant information gap at the top. 60% of organisations quantify potential cyber loss exposure, split between annual (19%) and ongoing (41%) assessments. 48% of respondents already have cyber insurance, and 19% plan to obtain it within two years; of those insured, 71% have standalone policies. Budgeting for cyber insurance is split, with 48% including it in cybersecurity budgets and 52% allocating a separate budget. Phishing/social engineering (48%) and ransomware (38%) are the top global concerns, with third-party software vulnerabilities and AI misuse each cited by 31%. 62% conducted a cyber incident response test in the past year, 63% feel well prepared for incidents, and 78% have a response plan. The survey sample is diverse: 53% privately held, for-profit companies, 25% listed, with 36% under $50 million in revenue, 35% between $50 million and $1 billion, 15% between $1 billion and $5 billion, and 14% above $5 billion. Services, industrial, and finance/insurance sectors each represent significant portions of respondents.

Analysis

The announcement is a factual summary of survey results regarding cyber risk management and insurance adoption among organisations, with all key statistics clearly supported by disclosed numerical data. The tone is neutral and descriptive, with no exaggerated claims about WTW's own performance or prospects. Forward-looking statements are minimal and limited to general recommendations (e.g., leaders should regularly test preparedness), not specific projections or promises. There is no mention of capital outlay, investment, or financial impact for WTW, nor any attempt to link survey findings to immediate or future company earnings. The narrative does not inflate the significance of the findings or overstate their implications for WTW. All claims about industry trends are either directly supported by survey percentages or clearly presented as qualitative observations.

Risk flags

• ●Despite widespread board-level integration of cyber risk, only 55% of respondents feel well informed about their organisation’s cyber risks, and just 46% believe their board understands the effectiveness of cybersecurity spending. This knowledge gap at the leadership level could undermine the effectiveness of risk management strategies.
• ●The split in budgeting for cyber insurance—48% within cybersecurity budgets and 52% as a separate line item—may signal inconsistent approaches to financial planning for cyber risk, potentially leading to underfunded or misaligned risk mitigation efforts.
• ●Phishing, social engineering, ransomware, third-party software vulnerabilities, and AI misuse remain top concerns, cited by 31–48% of respondents. This persistent threat landscape means that even well-prepared organisations face evolving risks that could outpace current controls.
• ●While 78% of organisations have a response plan and 62% have tested it in the past year, the remaining minority may be unprepared for a significant incident, exposing them to operational and reputational damage.

Bottom line

This survey from Willis, a WTW business, confirms that cyber risk is now a central concern for boards, with 70% of organisations formally integrating it into their risk frameworks and nearly half already holding cyber insurance. Despite this, only 55% of respondents feel well informed about their cyber risks, and less than half believe their board understands the effectiveness of cybersecurity spending, highlighting a persistent leadership knowledge gap. Insurance adoption is growing, but budgeting practices vary, and the threat landscape remains dynamic, with phishing, ransomware, and AI misuse among the top concerns. Preparedness is improving, with most organisations having response plans and conducting incident tests, but a significant minority remain exposed. For investors, the key takeaway is that while governance structures are evolving rapidly, the effectiveness of these measures depends on closing the information and preparedness gaps at the board level. Further disclosures on actual incident outcomes and financial impacts would be needed to assess whether these governance changes translate into reduced risk or improved financial performance.

Announcement summary

(NASDAQ:WTW) Willis, a WTW business, released the Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus, revealing that 70% of organisations now formally integrate cyber risk into their board-level enterprise risk framework. The survey found that 65% of boards receive cybersecurity and threat landscape updates at least quarterly. Sixty per cent of respondents quantify potential financial losses from a cyber incident either annually (19%) or on an ongoing basis (41%). Only 55% of respondents feel well informed about the cyber risks facing their organisation, and just 46% believe their board is well informed about how effectively cybersecurity spending reduces risk exposure. Almost half of respondents (48%) have cyber insurance in place, with a further 19% planning to buy it in the next two years. Of those with cyber insurance, 71% purchase standalone cover, while 29% have cover through a general or combined insurance policy. Forty-eight per cent include the cyber insurance premium within their cybersecurity budget, while 52% allocate a separate budget. Phishing and social engineering (48%) and ransomware (38%) are the top two global cyber concerns, with third-party software vulnerabilities (31%) and AI misuse (31%) also ranking highly. In terms of preparedness, 62% of respondents completed a cyber incident response testing exercise in the previous 12 months. 63% feel well prepared to manage a cyber incident effectively, and 78% have a cyber incident response plan in place. The survey indicates a shift from prevention-only thinking towards resilience, with organisations prioritising their ability to respond, recover, and minimise business disruption. Glyn Thoms, global FINEX cyber strategy leader at Willis, stated that cyber risk is now a core business risk requiring greater board oversight and accountability. The survey also notes that cyber insurance is increasingly seen as an enabler of resilience and a governance driver, with its inclusion in cybersecurity budgets reflecting its importance for financial protection and access to incident response specialists. The survey sample includes 53% privately held, for-profit companies, 25% listed, for-profit companies, 36% with revenues up to $50 million, 35% with revenues between $50 million and $1 billion, 15% between $1 billion and $5 billion, and 14% with more than $5 billion in revenue. Services account for 30% of respondents, industrial companies 18%, and finance and insurance companies 18%.

Disagree with this article?