Business

Willis: 70% build cyber into board risk, but only 48% are insured

Willis’s global D&O survey: 70% build cyber into board risk frameworks, but only 46% think boards can judge security spend and 48% are insured.

Bar chart motif with the headline 'Boards own cyber risk, cover still lags' illustrating the Willis cyber governance survey.

A new Willis survey suggests cyber risk has firmly reached the boardroom agenda, with seven in ten organisations folding it into enterprise risk frameworks. But fewer than half carry cyber insurance, and only 46% think their board can tell whether security spending actually reduces exposure.

What happened

On 21 October 2026, Willis, the broking arm of WTW, published its Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus. The release was issued from London, but the survey itself is global: Willis has not published a sample size or any UK-specific breakdown, so the figures below describe a worldwide pool of respondents rather than British boards in particular. According to Insurance Business, private and mid-sized companies made up most of the respondents.

The headline numbers are encouraging on governance structure. Seventy per cent of organisations say cyber risk is now formally written into their board-level enterprise risk framework, and 65% of boards are briefed on security and the threat landscape at least once a quarter. For the first time, Willis asked how often firms put a financial value on a potential cyber incident: 60% said they do, 19% annually and 41% on a continuing basis.

The weaker numbers concern understanding and protection. Just 55% of respondents consider themselves well informed on the cyber threats facing their organisation, and only 46% believe their board knows how effectively security spending reduces risk. Cyber insurance is held by 48%, with a further 19% intending to buy within two years.

The detail

Among insured organisations, 71% buy standalone cyber policies, while 29% rely on cover bundled into a general or combined policy. The budgeting split is revealing: 48% pay the cyber premium out of the security budget, and 52% fund it separately.

Asked about threats, respondents still put social engineering and phishing first (48%), followed by ransomware (38%). Third-party software vulnerabilities and AI misuse are tied at 31%, and both now sit inside the top five concerns, a shift Willis links to the changing claims environment.

Preparedness looks reasonable on paper. Some 78% have an incident response plan, 62% ran a response exercise in the past year, and 63% say they feel well prepared to handle an incident. Glyn Thoms, Willis’s global FINEX cyber strategy leader, said the results show cyber has become “a core business risk, demanding greater board oversight and accountability”. He also argued that insurance is no longer seen purely as risk transfer but increasingly as an enabler of resilience, partly because policies bring access to incident response specialists.

Key statistics from the Willis D&O Liability Insurance Survey 2026: Cyber in Focus, covering board integration, loss quantification, confidence, insurance uptake and incident planning.

Why it matters for UK organisations

The UK context makes these numbers more pointed. The government’s Cyber Governance Code of Practice, promoted by the NCSC, is aimed squarely at boards and directors of medium and large organisations. Its five principles cover risk management, strategy, people, incident planning and recovery, and assurance and oversight. Several of the Willis findings map almost directly onto that code: quarterly board briefings and formal risk integration speak to the first principle, while the 46% figure on spending effectiveness is precisely the kind of assurance gap the fifth principle is meant to close.

Willis’s own July edition of its global D&O survey, which did report regional results, placed cyber attack as the number one directors’ risk in Great Britain, rated very or extremely important by 83% of respondents there, with data loss second at 82%. That report also flagged the Cyber Security and Resilience Bill, noting that a wider set of regulated entities and new incident reporting duties could increase how often organisations must notify regulators and, in turn, push up the frequency and severity of insurance claims.

Put together, the direction of travel for UK boards is clear even if this particular survey cannot tell us how British respondents answered. Directors are expected to own cyber risk, regulators are widening reporting duties, and insurers are reading board oversight as a signal of insurability.

Expert view

The figure that stands out to me is not the 70%. Writing cyber into a risk register is the easy part; it is a governance artefact. The more telling number is that fewer than half of respondents think their board can judge whether the security budget is working. In my experience, that gap usually comes from reporting that leans on activity metrics, such as tickets closed, patches deployed or phishing simulations run, rather than outcomes such as time to detect, time to contain or how far an attacker got during the last test.

The quantification result deserves some scepticism too. Sixty per cent claim to estimate financial loss, but the quality of those estimates varies enormously. A figure built from a realistic scenario, including business interruption, regulatory costs and recovery time, is useful. A figure pulled from an industry average is not, and it can give a board false comfort about limits and retentions.

I would also caution against reading 63% “well prepared” too literally. When we run tabletop exercises or full red team engagements, confidence often drops sharply once the scenario reaches the point where the identity platform, backups or a key supplier are unavailable. The 29% relying on bundled cover should check carefully whether those policies respond to supplier software failures or AI-related incidents, the very exposures respondents now rank in their top five.

What to do now

  1. Change what the board sees. Replace activity counts with a small set of outcome measures: mean time to detect and contain, critical vulnerability exposure windows, and findings from the latest penetration test or red team exercise.
  2. Benchmark against the Cyber Governance Code of Practice. Walk the board through the five principles and record where actions are complete, partial or missing. This gives directors evidence of oversight if they are later questioned.
  3. Make loss quantification scenario-based. Model two or three plausible incidents, such as ransomware on core systems or a supplier compromise, and use the results to test insurance limits and excesses.
  4. Review combined policies. If cyber cover sits inside a general policy, ask your broker explicitly about third-party software failure, AI misuse and incident response support.
  5. Test recovery, not just the plan. Run an exercise that assumes loss of identity services and primary backups. Validate restores rather than assuming them.
  6. Keep the basics visible. Insurers still ask about the fundamentals. Cyber Essentials controls, particularly secure configuration, user access control, security update management and malware protection, remain a sensible baseline to evidence to underwriters and boards alike.

Bottom line

The Willis survey is a global snapshot, with no published sample size or UK split, so it should be treated as an indicator rather than a precise measure of British boards. Even so, the pattern it describes is familiar: governance structures are in place, but understanding, assurance and insurance cover lag behind. With the Cyber Governance Code of Practice setting expectations and the Cyber Security and Resilience Bill widening reporting duties, UK directors who cannot show how their security spending reduces risk are likely to find that gap harder to defend.

Sources

Related Posts