Willis, a business of global advisory, broking and solutions company WTW, has reported that cyber security is becoming an increasingly prominent issue for corporate boards, as cyber attacks and data loss continue to rank among the main concerns for directors and officers.
Its latest Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus found that 70% of organisations have formally incorporated cyber risk into their enterprise risk frameworks at board level. The research also found that 65% of boards receive briefings on cyber security and the wider threat environment at least once every three months.
According to Willis, the results highlight the growing role of cyber risk in corporate decision-making, with boards and chief executives taking a more active part in overseeing how organisations identify and manage their exposure.
For the first time, the 2026 survey asked participants how often their organisations calculate the potential financial impact of a cyber incident. Overall, 60% said they quantify possible losses, with 19% carrying out assessments annually and 41% doing so on an ongoing basis.
Despite this focus, the findings identified gaps in awareness at senior levels. Just 55% of respondents said they had a good understanding of the cyber risks affecting their organisation, while 46% considered their board sufficiently informed about the effectiveness of cyber security expenditure in reducing risk.
The survey also explored how organisations approach cyber insurance. Willis found that 48% of respondents already held a policy, while another 19% intended to purchase cover within the next two years. Among those with insurance, 71% had a standalone cyber policy, compared with 29% who obtained protection through a general or combined insurance arrangement.
Budgeting practices varied, with 48% of insured respondents accounting for their cyber insurance premiums within their overall cyber security budgets. The remaining 52% managed the cost separately, according to Willis.
Phishing and social engineering were identified as the most prominent cyber threats, cited by 48% of respondents worldwide. Ransomware followed at 38%. Third-party software vulnerabilities and the misuse of artificial intelligence each attracted 31% of responses, placing them among the five leading concerns. Willis attributed these results to changes in the cyber risk landscape and the claims environment.
Organisational readiness was another area covered by the research. Willis reported that 62% of respondents had carried out a cyber incident response test during the preceding 12 months. Although 63% expressed confidence in their organisation’s ability to manage a cyber incident effectively, 78% said a formal response plan was in place.
The results suggest that organisations are placing greater emphasis on their capacity to withstand and manage cyber incidents, rather than relying solely on preventative controls. Willis highlighted response planning, operational recovery and the reduction of business interruption as important elements of this approach.
Glyn Thoms, Global FINEX Cyber Strategy Leader at Willis, added: “Cyber risk is now a core business risk, demanding greater board oversight and accountability. Leaders should regularly test their organisation’s preparedness and recovery capabilities to reduce operational disruption and improve their ability to respond and recover when an incident occurs.”
Thoms continued: “Our survey points to a shift in how cyber insurance is viewed. No longer simply a risk transfer solution, it is increasingly recognised as an enabler of resilience. Its inclusion within cybersecurity budgets reflects its importance as a governance driver and a mechanism for financial protection, as well as the access it provides to incident response specialists. To maximise these benefits, policies should be reviewed regularly as cyber risks continue to evolve.”
