New data has found seven in ten organisations (70%) are now formally integrating cyber risk into their board-level enterprise risk framework as threats rise.

Broker Willis said while 65% of boards receive cybersecurity and threat landscape updates at least quarterly, cyber-attacks and data loss remaining among directors’ and officers’ leading concerns.

The data came as Willis published according its latest Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus.  The findings show cyber risk is firmly established as a board-level business issue, driving greater board and CEO engagement in cyber governance.

This year, respondents were asked for the first time how regularly they quantify potential financial losses from a cyber incident. Sixty per cent said they do so either annually (19%) or on an ongoing basis (41%). However, only 55% feel well informed about the cyber risks facing their organisation, and just 46% believe their board is well informed about how effectively cybersecurity spending reduces risk exposure.

Glyn Thoms, global FINEX cyber strategy leader at Willis, said: “Cyber risk is now a core business risk, demanding greater board oversight and accountability. Leaders should regularly test their organisation’s preparedness and recovery capabilities to reduce operational disruption and improve their ability to respond and recover when an incident occurs.

“Our survey points to a shift in how cyber insurance is viewed. No longer simply a risk transfer solution, it is increasingly recognised as an enabler of resilience. Its inclusion within cybersecurity budgets reflects its importance as a governance driver and a mechanism for financial protection, as well as the access it provides to incident response specialists. To maximise these benefits, policies should be reviewed regularly as cyber risks continue to evolve.”

Other key findings from the survey include:

• Cyber insurance: Almost half of respondents (48%) have cyber insurance in place, with a further 19% planning to buy it in the next two years. Of those with cyber insurance, 71% purchase standalone cover, while 29% have cover through a general or combined insurance policy. Forty-eight per cent include the cyber insurance premium within their cybersecurity budget, while 52% allocate a separate budget.
• Cyber exposure: Phishing and social engineering (48%) and ransomware (38%) remain the top two global concerns. Third-party software vulnerabilities (31%) and AI misuse (31%) now rank among the top five global concerns, reflecting the changing risk and claims environment.
• Preparedness: 62% of respondents completed a cyber incident response testing exercise in the previous 12 months. 63% feel well prepared to manage a cyber incident effectively, and 78% have a cyber incident response plan in place. The findings point to a shift from prevention-only thinking towards resilience, with organisations prioritising their ability to respond, recover and minimise business disruption.

 Peter Foster, Chairman, global FINEX cyber added: “Our latest survey reinforces cyber risk as a board-level issue, rather than simply a technology concern.

“As cyberattack and data loss remain among the most significant risks facing directors and officers globally, we’re seeing boards and CEOs taking a more active role in cyber risk governance and oversight.

“While you can’t prevent cyberattacks entirely, your ability to respond to, recover from and minimise disruption is becoming a critical measure of your organization’s cyber maturity.”

He continued: “Businesses are investing in their ability to respond to cyber incidents, recover and limit disruption. Incident response planning, testing and preparedness now play a greater role, alongside security controls.

“Organisations are using cyber insurance for more than risk transfer. Its inclusion in many cybersecurity budgets reflects its importance as a governance driver, a mechanism for financial protection and the access it provides to incident response specialists.”