A global Willis survey found that only 46% of respondents considered their boards well informed about the risk reduction from cybersecurity spending, despite 70% reporting formal board-level cyber risk frameworks.
The findings come from the 2026 Directors’ & Officers’ Liability Insurance Survey: Cyber in Focus, which WTW dates Oct. 8. Willis announced the findings Oct. 21. Willis, a WTW business, said the survey reflects the views of directors, officers and risk managers worldwide. Privately held, for-profit companies made up 53% of participating organizations, and listed, for-profit companies accounted for 25%.
Phishing and social engineering topped respondents’ cyber concerns at 48%, followed by ransomware at 38%. Vulnerabilities in third-party software and misuse of artificial intelligence each drew 31%, placing both among the five leading concerns.
Boards received regular information on threats, according to many respondents: 65% said their boards got cyber updates at least quarterly. Separately, 55% said they felt well informed about the risks facing their own organizations.
The survey asked for the first time how often organizations estimate the financial loss a cyber incident might cause. Some 41% of respondents said their organizations do so on an ongoing basis, and 19% said they make an annual estimate. Together, those responses amounted to 60%.
Plans for handling an incident were more common than recent practice exercises. While 78% reported having a cyber incident response plan, 62% said their organizations had completed an exercise in the previous 12 months. Separately, 63% felt well prepared to manage an incident.
Cyber insurance was held by 48% of respondents. Among those with coverage, 71% had standalone policies and 29% were covered under general or combined policies. Insured respondents split almost evenly on how they paid premiums: 48% included them in cybersecurity budgets, while 52% used a separate budget. Another 19% of all respondents planned to buy coverage within two years.
Willis said insurance can provide financial protection and access to incident response specialists. Willis global FINEX cyber strategy leader Glyn Thoms urged leaders to test their organizations’ response and recovery capabilities regularly to reduce disruption.
