Cyber risk has become a firm board-level issue, but many directors still lack confidence in what they’re told about it, according to a global survey from Willis, a WTW business.
Its Directors’ and Officers’ Liability Insurance Survey 2026: Cyber in Focus found that 70% of organizations now formally include cyber risk in their board-level enterprise risk framework. Some 65% of boards receive updates on cyber security and the threat landscape at least quarterly.
For the first time, the survey asked how often organizations quantify potential financial losses from a cyber incident. Sixty per cent said they do so, either annually (19%) or on an ongoing basis (41%).
Engagement hasn’t fully translated into understanding. Only 55% of respondents said they feel well informed about the cyber risks their organization faces. Just 46% believe their board is well informed about how effectively cyber security spending reduces risk.
“Cyber risk is now a core business risk, demanding greater board oversight and accountability,” said Glyn Thoms, global FINEX cyber strategy leader at Willis.
Almost half of respondents (48%) have cyber insurance, and a further 19% plan to buy it within two years. Of those insured, 71% buy standalone cyber cover, while 29% are covered through a general or combined policy.
Organizations are split on how they budget for it. Some 48% include the premium in their cyber security budget, while 52% fund it separately. Thoms said including cyber insurance in security budgets showed that it is increasingly seen as part of an organization’s resilience, with value that includes access to incident response specialists, as well as risk transfer.
Phishing and social engineering (48%) and ransomware (38%) remain the two biggest cyber concerns globally. Vulnerabilities in third-party software (31%) and misuse of AI (31%) are now among the top five.
On preparedness, 78% of organizations have a cyber incident response plan, and 62% tested their response in the past 12 months. Some 63% feel well prepared to handle an incident.
For brokers, the survey shows both an opportunity and a gap. With fewer than half of organizations carrying cyber cover, and nearly one in five planning to buy it, there is significant room for growth, particularly among the private and mid-sized companies that made up most respondents.
The 29% relying on cyber cover within general or combined policies are worth a closer look. Those policies often carry lower limits and narrower terms than standalone cyber cover. As concerns shift towards third-party software failures and AI misuse, brokers should check whether combined policies respond to those exposures.
The confidence gap is also a D&O issue. Directors who can’t show that they understand and oversee cyber risk may face scrutiny after a serious incident. Brokers who help boards quantify cyber exposure and document their oversight support both the cyber and D&O placements.
