Cyber attacks and data loss drive greater board-level focus on cyber risk, says Willis

Cyber incident response plans are in place at 78% of respondents, while 62% tested their response in the previous 12 months.

Rhea-AI Summary

WTW (NASDAQ: WTW) published a Willis survey showing 70% of organisations formally integrate cyber risk into board-level risk frameworks. The 2026 Directors’ & Officers’ Liability Insurance Survey: Cyber in Focus found 65% of boards receive cybersecurity and threat updates at least quarterly.

Potential cyber losses are quantified annually by 19% of respondents and on an ongoing basis by 41%. However, only 55% feel well informed about their organisation’s cyber risks, and 46% believe their board understands how effectively cybersecurity spending reduces exposure. Cyber insurance is in place for 48% of respondents, while another 19% plan to buy it within two years.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

LONDON, Oct. 21, 2026 (GLOBE NEWSWIRE) -- Seven in ten organisations (70%) now formally integrate cyber risk into their board-level enterprise risk framework, while 65% of boards receive cybersecurity and threat landscape updates at least quarterly, according to the latest Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus from Willis, a WTW business (NASDAQ: WTW). With cyber attacks and data loss remaining among directors’ and officers’ leading concerns, the findings show cyber risk is firmly established as a board-level business issue, driving greater board and CEO engagement in cyber governance.

This year, respondents were asked for the first time how regularly they quantify potential financial losses from a cyber incident. Sixty per cent said they do so either annually (19%) or on an ongoing basis (41%). However, only 55% feel well informed about the cyber risks facing their organisation, and just 46% believe their board is well informed about how effectively cybersecurity spending reduces risk exposure.

Other key findings include:

• Cyber insurance: Almost half of respondents (48%) have cyber insurance in place, with a further 19% planning to buy it in the next two years. Of those with cyber insurance, 71% purchase standalone cover, while 29% have cover through a general or combined insurance policy. Forty-eight per cent include the cyber insurance premium within their cybersecurity budget, while 52% allocate a separate budget.
• Cyber exposure: Phishing and social engineering (48%) and ransomware (38%) remain the top two global concerns. Third-party software vulnerabilities (31%) and AI misuse (31%) now rank among the top five global concerns, reflecting the changing risk and claims environment.
• Preparedness: 62% of respondents completed a cyber incident response testing exercise in the previous 12 months. 63% feel well prepared to manage a cyber incident effectively, and 78% have a cyber incident response plan in place. The findings point to a shift from prevention-only thinking towards resilience, with organisations prioritising their ability to respond, recover and minimise business disruption.
  
  

Glyn Thoms, global FINEX cyber strategy leader at Willis, said: “Cyber risk is now a core business risk, demanding greater board oversight and accountability. Leaders should regularly test their organisation’s preparedness and recovery capabilities to reduce operational disruption and improve their ability to respond and recover when an incident occurs.”

“Our survey points to a shift in how cyber insurance is viewed. No longer simply a risk transfer solution, it is increasingly recognised as an enabler of resilience. Its inclusion within cybersecurity budgets reflects its importance as a governance driver and a mechanism for financial protection, as well as the access it provides to incident response specialists. To maximise these benefits, policies should be reviewed regularly as cyber risks continue to evolve.”

The full report is available here.

About the survey:

The survey provides a global view of risk perceptions among directors, officers and risk managers. Privately held, for-profit companies account for the largest share of respondents (53%), followed by listed, for-profit companies (25%). By revenue, 36% of participating companies have revenues of up to $50 million, 35% have revenues of between $50 million and $1 billion, 15% between $1 billion and $5 billion, and 14% more than $5 billion. Services account for the largest proportion of respondents (30%), followed by industrial companies (18%) and finance and insurance companies (18%).

About WTW

At WTW (NASDAQ: WTW), we provide data-driven, insight-led solutions in the areas of people, risk and capital. Leveraging the global view and local expertise of our colleagues serving 140 countries and markets, we help organizations sharpen their strategy, enhance organizational resilience, motivate their workforce and maximize performance.

Working shoulder to shoulder with our clients, we uncover opportunities for sustainable success—and provide perspective that moves you.

Learn more at wtwco.com.

Media contact

Jo Barrett

jo.barrett@wtwco.com

Lauren David

Lauren.david@wtwco.com