Chubb’s latest survey of UK and Irish mid-sized firms puts cyber at the top of the risk register, with 70% rating it a major or significant threat. Yet only around a third say they regularly review and tailor their cyber insurance, and the gap is widest among firms that have not yet been hit.
What happened
On 11 November 2026 the insurer Chubb published its Middle Market Risk Radar 2026 for the UK and Ireland. The research is based on a survey of 150 people responsible for insurance or risk management decisions, carried out in July. Chubb splits respondents into two bands: “small” firms turning over £50m to £100m (or the euro equivalent in Ireland) and “mid-size” firms turning over £100m to £500m.
According to Chubb, cyber security, data privacy and financial crime came out as the highest-ranked risk, with 70% of respondents rating it major or significant. That put it ahead of economic uncertainty (64%), recruiting and keeping talent (62%) and operational risk (61%). Nine in ten businesses told Chubb they had suffered at least one disruptive event in the last three years, and the full report says 83% had been affected by a cyber or data breach incident over that period.
The headline business finding, though, is about insurance rather than threats. Chubb’s survey found that just 36% of firms hold a cyber policy they regularly review and adapt as risks change. Among firms with no previous cyber incident, that figure falls to 28%, while businesses that had already been through one were close to twice as likely to have tailored cover.
The detail
The incident breakdown in Chubb’s report reads like a typical incident response caseload. Phishing or business email compromise leading to financial loss was the most common event, cited by 42% of respondents. Next came disruption triggered by an incident at a supplier or tech provider (37%), then data breaches involving customer, staff or business data (30%), theft of, or unauthorised access to, business information (29%) and ransomware or other malware (28%).
There is a clear split by size. Chubb reports that 81% of its mid-size respondents rate cyber as a major risk, compared with 52% of the smaller band. Confidence is high across the board: 77% say they are completely or very prepared for a data breach or cyber attack, and 72% say the same about a major IT outage that is not caused by an attack.
Artificial intelligence features heavily. Chubb found 54% of firms already use AI tools to help detect and respond to threats, but 87% agree AI is now so embedded in their operations that its risks are hard to fully grasp. The top AI concern was an outage, breach or failure at a third-party AI provider (71%), followed by deepfake or AI-enabled impersonation fraud (69%). Actions lag behind worries: 53% have strengthened payment authentication against deepfake fraud, 47% have documented which AI tools are used and by whom, and only 42% have tested what an AI incident would do to operations.
The survey sits alongside Chubb’s own claims data. Its 2026 Cyber Claims Report, released in August, found that claim frequency among European and UK mid-market policyholders dropped in 2025 to its lowest level in five years, while the average claim value roughly tripled between 2020 and 2025.
Why it matters for UK organisations
For the UK cyber insurance market, the combination of fewer but costlier claims and patchy policy maintenance is uncomfortable. Association of British Insurers figures cited by Insurance Business show UK cyber payouts rose from £59m in 2023 to £197m in 2024. Chubb, quoting Department for Science, Innovation and Technology data in August, said just 24% of medium-sized UK businesses have a standalone cyber policy. Many others rely on cyber sections bolted onto wider packages, which may not reflect how the business actually runs today.
The supplier figure deserves particular attention. More than a third of respondents were disrupted by someone else’s incident, and the most-feared AI risk is a failure at an outside provider. That is contingent business interruption territory, an area where wordings vary widely and where firms often discover limits only when they claim. The UK has already seen what this looks like at scale: Insurance Business points to one UK ransomware case where losses across the supply chain far exceeded those of the company attacked, with more than 5,000 UK organisations affected.
Expert view
The finding that firms buy better cover only after being burned will surprise nobody who works in incident response. Chubb’s Jimaan Sané summarised it as “experience is the best teacher”, which is accurate, if expensive. In my experience, the organisations that recover well are the ones that have rehearsed the call to the insurer’s breach panel before they needed it, and that know exactly which suppliers are named in their policy.
I would treat the 77% preparedness figure with some caution. Self-assessed readiness is almost always higher than what we find when we test. Business email compromise topping the incident list tells you that basic payment controls and identity hygiene are still failing in firms turning over £50m or more. In tabletop exercises, the weak point is usually a process, such as a changed bank detail approved on the strength of a convincing email.
The AI numbers follow a familiar pattern. Firms are adopting tools quickly and worrying about the risks, but fewer than half have documented what is in use. You cannot insure, govern or defend what you have not inventoried, and underwriters are increasingly asking.
A word of balance: this is one insurer’s survey of 150 decision-makers, and Chubb has an obvious interest in the conclusion that firms need better cover. The direction of travel, however, matches what the wider claims data and UK government research show.
What to do now
- Read your cyber wording against your current business. Check limits, sub-limits and exclusions for contingent business interruption, named suppliers, cloud and AI providers, and overseas operations. Review at every renewal and whenever you add a major supplier or market.
- Map critical suppliers. List the technology and service providers whose outage would stop you trading, and agree with your broker how a failure at each would be treated.
- Harden payment processes. Require out-of-band verification for any change to bank details or urgent transfer, and enforce MFA on email and finance systems (Cyber Essentials: user access control).
- Inventory AI tools. Record what is in use, by whom and with what data, and restrict sensitive data where needed.
- Test, do not assume. Run a tabletop that includes your insurer’s incident hotline and a supplier outage, and prove you can restore from backups (Cyber Essentials: security update management and malware protection support this baseline).
- Close the basics. Patch internet-facing systems promptly and remove default or unused accounts (Cyber Essentials: secure configuration, firewalls).
Bottom line
Chubb’s survey says UK and Irish mid-sized firms know cyber is their biggest risk, yet most are not keeping their insurance in step with it, especially those that have not been attacked yet. With claims getting rarer but more expensive, and supplier failures now a leading cause of disruption, the time to check the policy wording is before the incident, not after it.
Sources
- Chubb: Nine in ten middle market businesses in the UK and Ireland hit by disruption while pursuing ambitious growth
- Chubb: Middle Market Risk Radar 2026 (report)
- Chubb: Middle Market Risk Radar 2026
- Chubb: Cyber attacks become more costly for mid-sized UK and European businesses despite falling claims volumes
- Insurance Business UK: Mid-market cyber severity has tripled even as claims fall
