Global Directors’ and Officers’ Survey Report 2026 – Cyber

Cyber risk: The boardroom priority that still catches organizations off guard

Cyber attack and data loss have occupied the upper echelons of the WTW directors’ and officers’ risk rankings for the better part of a decade and the Global Directors’ and Officers’ (D&O) Liability Insurance Survey 2026 confirms that this trend shows no sign of abating. Cyber attack (including cyber extortion) was rated "very important" or "extremely important" by 75% of respondents, whilst the more general, but clearly related, concern around “data loss” sits marginally higher at 76%. These two risks have traded places at or near the top of the table since 2018, when data loss first claimed the number one spot. To put that longevity in context, no other risk category has maintained such sustained prominence across successive surveys.

The question for boards in 2026 is not whether cyber risk matters. It plainly does. The more challenging question, and one that this article seeks to explore, is whether boards are doing enough — both from an operational and an insurance perspective — to protect their organizations and, critically, themselves.

A decade at the top: Cyber risk in historical context

Source: 2013–2026 Global D&O Liability Insurance Survey data

Figure 1: Cyber attack and data loss — percentage rated "very important" or "extremely important" (2024–2026)

The table above reveals a striking pattern. Since 2021, health and safety has displaced cyber risk from the top position, yet cyber-related risks (if we combine cyber attack and data loss) cumulatively consistently attract a higher degree of concern than any other risk pairing in the survey. It is also notable that, unlike many other risks in the 2026 survey which saw year-on-year declines (for example regulatory breach, or diversity, equality and inclusion) cyber attack and data loss have remained broadly stable. This suggests that respondents see cyber risk as a core part of doing business, not just a short-term issue.

The interconnected nature of modern supply chains means that a single cyber event can cascade rapidly across multiple jurisdictions and counterparties. The proliferation of ransomware, the weaponisation of artificial intelligence in phishing and deepfake campaigns, the reliance on a small number of IT service providers and the increasing regulatory expectations around cyber resilience all reinforce why this risk stubbornly refuses to recede from the boardroom agenda.

Larger companies feel the heat — but no one is immune

The Global D&O Liability Insurance Survey 2026 data reveals a compelling gradient. For organizations with revenues of USD 1 billion or more, cyber attack claims the number one risk position outright, rated "very important" or "extremely important" by 89% (USD 1–5 billion) and 86% (USD 5 billion or more) of respondents respectively. Data loss follows closely, at 86% and 82% for those same revenue brackets. By contrast, smaller organizations (under USD 50 million in revenue) rank cyber attack third at 64% and data loss second at 67%.

Cyber risk ranking by company size

Source: Global D&O Liability Insurance Survey 2026

This might give smaller organizations pause. The gap between 64% and 89% is unlikely to strictly reflect a proportionally lower risk exposure; it more likely reflects a proportionally lower appreciation of the threat. Small and mid-cap companies are frequently the most vulnerable to cyber incidents precisely because their defences, governance structures, colleague resource and insurance arrangements tend to be less mature. Whilst there might be thought to be higher rewards and therefore more motivation for cyber attacks on larger companies, experience tells us that the threat of a cyber attack does not discriminate by market capitalization.

A further dynamic underlying these figures is the growing significance of third-party and supply chain exposure. As systems become more interconnected, risk increasingly originates from external partners, with many incidents tracing back to vendors or service providers rather than the organization itself. This shifts the nature of board oversight: cyber risk is no longer contained within the organization, but distributed across an ecosystem where accountability is diffuse and control is indirect.

Regional variations: A global risk with local intensities

The regional breakdown of the Global D&O Liability Insurance Sruvey 2026 is equally informative. In Great Britain, cyber attack takes the number one position at 83%, with data loss second at 82%. North America mirrors this pattern exactly — 83% for cyber attack and 82% for data loss. Asia ranks data loss first (76%) and cyber attack second (76%). In Latin America, data loss leads at 78%, with cyber attack at 74%. Africa is notable for cyber attack ranking fourth at 89%, whilst data loss sits third also at 89%.

These figures should be read in the context of an evolving global regulatory landscape. The UK's Cyber Security and Resilience Bill proposes to expand the scope of regulated entities and introduce new incident reporting obligations. This legislation will have significant policyholder implications, potentially broadening the circumstances in which organizations must notify regulators of cyber incidents and, by extension, potentially increasing the frequency and severity of associated insurance claims. Organizations operating across multiple jurisdictions face the compounding challenge of navigating multiple, sometimes overlapping regulatory regimes.

Industry spotlight: Finance and insurance lead, but every sector is exposed

When the survey data is examined by industry, finance and insurance respondents rank both data loss and cyber attack joint first at 82%. The industrial sector places cyber attack second at 80% and data loss third at 76%. Healthcare ranks data loss second at 74% and cyber attack third at 67%. Energy and utilities, a sector with significant operational technology exposure, ranks cyber attack fifth at 73% and data loss second at 80%.

The energy and utilities figures are particularly noteworthy. Unlike traditional IT environments, operational technology systems often control physical processes — power generation, water treatment, manufacturing lines — where a cyber attack can cause not only data compromise but tangible physical harm, environmental damage, and business interruption on a scale that dwarves conventional cyber losses, with profound insurance implications both in terms of scope of cover (where the applicable policies often were not designed to cover losses triggered by a cyber attack and indeed may have specific cyber exclusions) and adequacy of limits under a cyber-specific policy, which were never envisaged to cover a catastrophic operational technology failure.

The boardroom disconnect: Time, skills and the governance gap

Perhaps the most thought-provoking finding in the 2026 survey relates to board governance of cyber risk. Cybersecurity and data privacy ranks fifth in terms of current board time allocation, with 26% of respondents placing it in their top three. It also ranks fifth for where more board time is needed, at 27%. Yet it fails to appear in the top five at all for materiality to the business, ranking sixth at 25%.

When it comes to board skills, only 65% of respondents agree that their fellow directors have the necessary skills and knowledge to provide effective oversight of cybersecurity and data privacy. That figure places it eleventh out of fourteen governance areas assessed.

This creates a troubling paradox. Cyber risk is consistently ranked as one of the top two or three risks facing directors and officers, and yet board do not rank it as one of the most material issues for the business. Boards appear to be allocating limited time to the topic whilst acknowledging that their directors lack the skills to oversee it effectively. How do boards reconcile rating cyber risk at 75–76% importance whilst simultaneously ranking their own competence to govern it at only 65%? And what does this mean for personal liability for the directors and officers?

The survey points to a broader governance misalignment between perceived importance, board attention, and oversight capability. The issue is not simply whether boards recognise cyber risk, but whether that recognition is translated into how they structure oversight and allocate time and expertise. After an incident, scrutiny is unlikely to focus solely on the attack itself, but on the board’s response—whether sufficient attention was devoted to the risk, whether appropriate expertise was in place and whether identified gaps were actively addressed. Where issues are recognised but not acted on, that inaction may itself become central to claims of oversight failure.

From an insurance recovery perspective, this governance gap is significant. In the event of a material cyber incident, there will be scrutiny over what the board knew, when they knew it, and what they did about it. If a board acknowledges — as 35% of respondents implicitly do — that its directors lack adequate cyber skills, that acknowledgment could itself become evidence of a failure of oversight. Directors and officers should review their D&O insurance programmes and ensure that they are aligned with the realities of both the threats the business faces and how well equipped they would be to handle an event. What recent largescale cyber incidents have highlighted is that, while it is perhaps unrealistic to expect directors to have the cyber skills of IT specialists, they have to be fluent in understanding the impact a cyber incident could have on the business as well as ensuring they are prepared to make decisive decisions in the midst of a cyber event.

Practical considerations: What should boards and their advisers be doing?

We would highlight the following practical considerations for boards and their legal advisers:

First, boards should ensure that cyber risk is not treated as a purely technical IT issue but is elevated to a business issue. While cyber incidents ordinarily start with the IT, it is the impact on the business operations that have far-reaching consequences. The survey data suggests that only 5% of respondents rank cybersecurity as the single most important topic for current board time, a figure that is difficult to reconcile with its position as a top-three risk overall.

Second, organizations should critically assess whether their insurance programmes — including D&O, cyber, and general liability — collectively provide adequate and coherent coverage for the full spectrum of cyber-related exposures. Too often, policyholders discover gaps in their coverage only after an incident. In this context, boards should ensure that cyber insurance coverage is regularly reassessed and aligned to their actual risk profile. As cyber risk increasingly intersects with operational and governance exposures, insurance should be managed as an active component of the broader risk framework, rather than treated as a one-time purchase and safeguard.

Third, the boardroom skills deficit identified in the survey demands urgent attention. Whether through targeted board recruitment, ongoing education programmes, or the appointment of specialist advisers, boards must close the gap between the importance they ascribe to cyber risk and their capacity to govern it.

Finally, as the regulatory environment continues to tighten directors should satisfy themselves that their organization's cyber incident response plans are not merely documented but have been tested through realistic tabletop exercises. The survey itself notes that cybersecurity and data privacy ranks fifth for where more board time is needed, yet the question remains: are boards heeding their own assessment?

Looking ahead

The Global Directors’ and Officers’ Liability Insurance Survey 2026 paints a picture of a global business community that recognises the severity of cyber risk but has not yet fully translated that recognition into action at board level. The data tells us that cyber risk is persistent, pervasive, and growing in complexity. It also tells us that boards know they are under-skilled to deal with it.

Ultimately, the survey data suggests that the primary exposure for directors may arise not just from a cyber incident itself, but from the adequacy of the board’s response to it. Where gaps persist between the recognised importance of cyber risk and the board’s capacity to oversee it, those gaps may become the focus of scrutiny in the aftermath of an event. In that sense, cyber risk is as much a test of governance as it is of technology.

The question is whether it will take a high-profile governance failure and the personal liability consequences that follow, to close the gap between awareness and action.