Cyber Attacks and Data Loss Rank Among Top Board-Level Risks, WTW Survey Finds
Cyber attack and data loss continue to rank among the top three risks facing directors and officers globally, trailing only health and safety as the top overall concern of these executives, unchanged from 2025, according to WTW’s Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus.
The survey found that 60% of respondents now quantify potential financial losses from a cyber incident annually or on an ongoing basis, a practice WTW said reinforces the growing importance of cyber risk quantification in understanding exposure. Cyber insurance also remains an important part of organizations’ overall approach to cyber risk, with 48% of respondents holding coverage and another 19% planning to purchase it within the next two years.
Board Oversight Grows, but Gaps in Knowledge Persist
The survey found cyber attacks and data loss ranked in the top two risks for directors and officers in Great Britain, Asia, North America and Latin America regions, with the Middle East the only region where neither risk featured in the top three. Across industries, cyber attacks and data loss appeared in the top three risks in every sector, ranking as the top two concerns specifically for finance and insurance. Energy and utilities was the only sector where cyber attack did not feature in the top three, WTW said.
Boards, CEOs and senior leadership continue to take a pivotal role in cybersecurity oversight, with 65% of boards now receiving updates on cybersecurity and the threat landscape at least quarterly. Yet only 65% of respondents agreed that their fellow board directors have the necessary skills and knowledge to provide effective oversight of cybersecurity and data privacy risk, the survey found.
Internal awareness also lags: just 55% of respondents said they feel well informed about their organization’s cyber risks and exposures, and only 46% believe their board is well informed about the effectiveness of cybersecurity investment in reducing exposure.
Phishing attacks and social engineering (48%) and ransomware (38%) remained the top two cyber exposure concerns ranked by respondents, WTW said. Third-party software vulnerabilities (31%) and A.I. misuse and deepfake attacks (31%) are now ranked in the top five, which WTW said aligns with the changing risk and claims environment.
Cybersecurity budgets are expected to keep rising in 2026, though at a slower pace than in 2025, with 49% of respondents anticipating increases compared with 56% the prior year, according to the survey.
Preparedness Improves, Though Confidence Remains Uneven
A large majority of respondents, 78%, said they have a cyber incident response plan in place, and almost two-thirds (62%) reported completing an incident response exercise within the past 12 months, WTW found. These percentages were significantly higher among companies with revenues over $1 billion, the survey noted.
Emma Pereira, an underwriter at Beazley, said organizations of all sizes are increasingly focused on their exposure to these risks, noting that “this heightened scrutiny is also driving a rise in related shareholder and regulatory actions against directors, particularly where there are perceived deficiencies in oversight, preparedness, or incident response.”
Cyber Insurance Tied to Broader Resilience Strategy
Among the 48% of organizations with cyber insurance in place, a significant majority (71%) purchase standalone cyber policies rather than bundling coverage into a combined policy, according to the survey. Funding of premiums is split nearly evenly, with 48% of respondents including the premium within their cybersecurity budget and 52% allocating it separately, a pattern WTW said supports the trend of cyber insurance being treated as part of, rather than separate from, an organization’s overall cybersecurity program.
WTW’s survey outlined six recommended actions for strengthening cyber resilience: elevating cyber risk as a board-level resilience issue, focusing on resilience rather than just technical protection, testing the organization’s ability to recover from a cyber security incident, prioritizing investment against the risks that matter most, quantifying cyber risk to support better decision-making, and treating cyber insurance as a resilience enabler that can strengthen preparedness, support incident recovery and provide access to specialist expertise when needed most.
Obtain the full report here. &

