Executives Say Their Companies Are Not Adequately Protected Against Cyberattacks

The share of C-level leaders who feel their organizations lack sufficient cyber protection has risen steadily to 89%, up from 81% in 2021, according to Munich Re's Global Cyber Risk and Insurance Survey 2026.
By: | May 1, 2026
cyber security

The perception of inadequate cybersecurity protection among senior executives has reached its highest level in four years of tracking, with 89% of global C-level respondents saying their company is not adequately protected against cyberattacks, according to Munich Re’s 2026 Global Cyber Risk and Insurance Survey.

The survey, conducted in December 2025 and encompassing more than 9,500 respondents across 20 countries, found that rising concern is matched by growing interest in cyber insurance — yet a significant share of organizations have still never been offered a policy.

“Companies need to place the highest priority on resilience and protection in the face of evolving digital opportunities and challenges,” Thomas Blunck, CEO Reinsurance for Munich Re, said. “As vital part of corporate risk management, cyber insurance is proven, relevant, and ready to expand.”

AI Reshapes the Risk Landscape

Artificial intelligence has overtaken cloud computing, data analytics and other technologies to become the most strategically relevant technology for businesses, the survey found. Seventy-one percent of C-level respondents identified AI as having significant relevance for their business, up from 62% in 2024. Fifty-seven percent of organizations said they already use AI in their operations.

While two-thirds of executives anticipate positive effects from AI, the technology is also generating new concerns. Data security and privacy topped the list of AI-related worries at 52%, followed by inaccurate results at 42%, cyberattacks at 42%, and lack of skills and resources at 36%, according to the survey. Only 23% of C-level respondents said they expect AI to have negative effects on their organization overall.

Munich Re said it expects cybercrime to become “increasingly automated and democratised” through AI tools, lowering the skill level required to launch an attack. The report warned that this trend will expand access to sophisticated attack capabilities, amplifying threats particularly for micro and mid-sized companies, and that the assumption a company is “too small or uninteresting to be attacked” is now obsolete.

Concern Levels High, Resilience Still Lagging

Sixty percent of C-level executives globally said they were concerned or extremely concerned about a potential cyberattack on their company, the survey found. Concern was highest in India and South Africa, both at 80%, followed by France at 71% and Japan at 70%. Respondents in the Netherlands (43%), the United Arab Emirates (47%) and China (48%) reported the lowest levels of concern.

The types of incidents driving those worries are also being felt in practice. Sixty-four percent of executives expressed concern about data breaches, with 45% reporting their company had actually been affected by one. Similar gaps between concern and experience appeared across ransomware, business interruption, cloud outages and digital supply chain disruptions, though the report noted the gap is narrowing as attacks grow more frequent and sophisticated.

Low security awareness among employees was cited as the top challenge to improving cyber threat defense, identified by 40% of C-level respondents. Lack of skilled personnel followed at 31%, with poor integration of security solutions at 30%.

Cloud dependencies also represent a major vulnerability. An overwhelming 98% of companies rely on cloud services, the survey found, and 62% of C-level respondents estimated a one-day cloud outage would result in a financial impact representing at least 11% of daily revenue.

Cyber Insurance Demand Grows but Distribution Gaps Persist

The survey revealed significant untapped demand for cyber insurance. Forty-three percent of C-level respondents said their company is considering purchasing a cyber policy and will very likely do so, up from 35% in both 2021 and 2022. The top reasons for purchasing coverage were reimbursement of financial losses from business interruption and from liability claims, each cited by 48% of respondents, followed by access to expert support and incident response services at 43%.

However, distribution remains a barrier. Only 52% of C-level respondents said they had ever been offered commercial cyber insurance, the survey found, while 33% said they had not. The report said expanding distribution and improving product transparency will be essential to closing the cyber protection gap.

Obtain the report here.

The R&I Editorial Team can be reached at [email protected].

More from Risk & Insurance