Cyber threats are the most connected risk facing large businesses, more likely than any other to trigger or amplify problems elsewhere, according to new research from Hiscox London Market.
The insurer's Risk in motion report, based on a survey of 800 risk managers at multination companies, found that cyber has the strongest links to other threats in the corporate risk system. Its tightest connection is with AI-enabled fraud -- 55% of respondents named cyber threats and AI-enabled fraud as the strongest risk combination they face.
Hiscox said cyber attacks can spill over into economic damage, workforce disruption, strained international relations and falling trust in institutions. Natural catastrophes, by contrast, despite dominating headlines, had weaker links to other risks and were less likely to drive knock-on effects.
The survey suggests risk managers are already living with that interconnection. Just over half (51%) said they regularly face multiple interconnected risks at once, and 27% said one risk event regularly triggers another.
Nearly two-thirds (65%) believe risks are more interconnected than five years ago, rising to 76% in the UK and 72% in the US. And 94% believe organisations still underestimate how far the impact of one event can cascade.
"In practice, risk is a system," said Kate Markham, chief executive of Hiscox London Market, in the report's introduction.
She said insurance had a role to play not just in paying for losses but in helping organisations build resilience before disruption occurs, and that insurability needed to be built in earlier.
The report points to organisational structure as a major weakness. Half of risk managers said their biggest challenge when multiple risks emerge at once is co-ordinating across teams, functions or insurance policies. Some 46% said they struggle to work out where one issue ends and another begins, and 84% said siloed business units slow their response.
Only 26% organize their risks around how threats interact, compared with 39% who categorize them by impact.
That has direct implications for how cover responds. When a cyber attack leads to fraud losses, business interruption and regulatory exposure at the same time, the losses can fall across several policies with different triggers and wordings. As Insurance Business has reported, these gaps between policy wordings are where claims often stall.
Investment is rising. Some 69% of risk managers expect risk management spending to increase over the next year, led by economic uncertainty (41%), resilience, emerging technology risks and regulatory change (40% each).
But fewer than half (48%) believe their current models capture interconnected risks very or extremely well. Economic uncertainty was also the main barrier to further investment, cited by 42%, followed by competing leadership priorities (38%), a belief that risks remain stable (37%) and expectations that AI can absorb workloads (35%).
Looking ahead, 42% named regulatory uncertainty around technology as a top emerging risk. Hiscox also highlighted autonomous machine-to-machine cyber attacks and quantum computers breaking current encryption as emerging threats with little historical data to model.
For brokers handling corporate clients, the findings make a case for reviewing programmes as a whole rather than line by line.
If cyber is the risk most likely to set off others, the critical questions are how cyber, crime, business interruption and directors' and officers' policies interact when one incident triggers losses across all of them, and where the gaps and overlaps sit.
The co-ordination finding is also an opportunity. Risk managers who say they struggle to work across teams and policies are effectively describing a service brokers can provide: mapping how a single event would flow through a client's insurance programme before it happens.
The survey was carried out by Wakefield Research between February 20 and March 3, 2026, across Australia, Canada, Denmark, Finland, France, Germany, Japan, Norway, Sweden, the UK and the US.
