Cyber risk is becoming an increasingly important board-level concern, with 70% of organizations now formally integrating it into their enterprise risk management frameworks, according to Willis' latest Directors' & Officers' Liability Insurance Survey 2026: Cyber in Focus. However, despite growing awareness of cyber threats, fewer than half of respondents currently have cyber insurance coverage.

The survey, published by Willis, a WTW business, found that 65% of boards receive cybersecurity and threat landscape updates at least quarterly, while 60% of organizations regularly quantify the potential financial impact of cyber incidents. Nevertheless, only 55% of respondents feel well informed about their organization's cyber exposure, and just 46% believe their boards adequately understand the effectiveness of cybersecurity investments.

Cyber insurance penetration remains relatively modest, with 48% of respondents reporting that they have coverage in place, while another 19% plan to purchase it within the next two years. Among insured organizations, 71% have standalone cyber policies, while the remaining 29% rely on coverage included in general or combined insurance policies.

Phishing and social engineering remain the most frequently cited cyber threats (48%), followed by ransomware (38%). Third-party software vulnerabilities and AI misuse, each mentioned by 31% of respondents, have also emerged among the leading concerns.

The findings also point to growing emphasis on cyber resilience and incident preparedness. While 78% of organizations have a cyber incident response plan, only 62% conducted a response testing exercise during the previous 12 months. Meanwhile, 63% of respondents believe their organizations are well prepared to manage a cyber incident.

“Cyber risk is now a core business risk, demanding greater board oversight and accountability,” said Glyn Thoms, Global FINEX Cyber Strategy Leader at Willis, emphasizing the importance of regularly testing incident response and recovery capabilities.

According to Willis, cyber insurance is increasingly viewed not only as a financial protection tool but also as an important component of organizational resilience, providing access to specialist incident response services and supporting more effective cyber risk management.

The full report is available here.