Seven in ten organizations now formally include cyber risk in their board-level enterprise risk framework, according to Willis’s Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus, released October 21. Cyber attacks and data loss remain among directors’ and officers’ leading concerns, and 65% of boards now receive cybersecurity and threat landscape updates at least quarterly.
Formal inclusion, however, is not the same as placement readiness. Only 55% of the directors, officers, and risk managers Willis surveyed feel well informed about the cyber risks their organization faces, and just 46% believe their board is well informed about how effectively cybersecurity spending reduces risk. A board can have cyber on the agenda and still arrive at a cyber or D&O placement unable to answer the first questions an underwriter asks.
That gap is the broker’s opening. The questions underwriting will ask are knowable in advance, and a broker who puts them to the board first — while there is still time to build the answers — turns a placement from an interrogation into a presentation. The survey numbers show exactly where the answers tend to be missing.
The survey in brief
For the first time, the Willis survey asked how regularly organizations quantify the potential financial losses from a cyber incident. Sixty percent said they do — 19% annually and 41% on an ongoing basis — which means 40% of organizations have no loss figure of their own to bring to a placement.
The coverage picture is just as unfinished. Almost half of respondents (48%) have cyber insurance in place, and a further 19% plan to buy it within the next two years. Of those insured, 71% buy standalone cyber cover, while 29% rely on a general or combined policy. The respondents skew toward the accounts where brokers do the heaviest lifting: privately held, for-profit companies made up 53% of the base, and by revenue 36% of companies were at up to $50 million and another 35% between $50 million and $1 billion.
Ask what the board can quantify
Can the board state its cyber exposure as a number? Sixty percent of organizations quantify potential cyber losses; the other 40% enter the market without one. Underwriters price scenarios, and a client-side loss estimate frames the submission — the limits discussion, the retention discussion, and the credibility of everything else in it. Without one, the carrier’s model produces the only number in the room, and the placement negotiates against it.
Which loss scenarios has the board actually priced? The survey’s concern ranking points to the scenarios that matter most to boards: phishing and social engineering (48%) and ransomware (38%) remain the top two, while vulnerabilities in third-party software (31%) and misuse of AI (31%) have moved into the top five. A board that has priced a ransomware event and a vendor failure has done much of the underwriter’s homework in advance. The third-party scenario deserves its own question, because someone else’s outage can become your client’s claim faster than most boards expect.
Can the board say what its security spending buys? Only 46% of respondents believe their board is well informed about how effectively cybersecurity spending reduces risk exposure. That is the weakest number in the survey, and it sits at the center of both placements: cyber underwriters probe control maturity, and D&O underwriters look for evidence that directors understood and oversaw the risk. A board that can connect its spending to reduced exposure answers both sets of questions with evidence instead of adjectives.
Ask what the board can document
Where does cyber sit in the risk register, and when did the board last see it? Seventy percent of organizations have put cyber into the enterprise risk framework, and 65% of boards get updates at least quarterly. The documentation question is whether both facts leave a paper trail — a register entry that exists and minutes that show the board reviewing it. A risk framework entry nobody can produce, attached to discussions nobody minuted, is difficult to evidence when a submission or a claim asks for it.
Is there an incident response plan, and when was it last tested? Seventy-eight percent of organizations have a cyber incident response plan, 62% completed a testing exercise in the previous 12 months, and 63% feel well prepared to manage an incident effectively. Those are three different numbers, and the gaps between them are the story: having a plan is not the same as having tested it, and having tested it is not the same as being ready. Willis’s Glyn Thoms makes the same point from the governance side — leaders should regularly test their organization’s preparedness and recovery capabilities to reduce disruption when an incident occurs.
Who owns the response when something happens? A response plan without a named owner, a deputy, and a reporting line to the board is a document rather than a control. Underwriters and directors both have an interest in the answer being a person, not a department, and in that person knowing — before the placement, not during the incident — that the role is theirs.
Ask where the cover actually sits
Is cyber hiding inside a combined policy? Twenty-nine percent of insured respondents are covered through a general or combined policy rather than a standalone cyber policy. As Insurance Business noted in its coverage of the survey, those policies often carry lower limits and narrower terms than standalone cover — a gap that matters more as board concerns shift toward third-party software failures and AI misuse, exposures a combined policy may not respond to the way the board assumes. The broker’s question is simple: has anyone checked whether the existing cover responds to a vendor outage or the other scenarios the board says it fears?
How is the premium budgeted? Forty-eight percent of respondents include the cyber insurance premium within their cybersecurity budget, while 52% fund it separately. Willis reads the first group’s choice as a signal: including cyber insurance in security budgets shows it is increasingly seen as part of an organization’s resilience, with value that includes access to incident response specialists as well as risk transfer. Where the premium sits tells a broker how the client frames the product — a compliance cost or a working part of the response capability — and that framing shapes the whole placement conversation.
The pre-placement checklist
A broker walking into the board conversation needs seven answers, each of which the survey suggests many boards cannot yet give:
- A current cyber loss figure the board has seen — produced annually or on an ongoing basis.
- Priced scenarios for the board’s top concerns, including a third-party software failure.
- A plain statement of what security spending reduces, and how the board knows it works.
- A risk-register entry for cyber, with a minuted board review cadence behind it.
- An incident response plan with a testing date inside the past 12 months.
- A named owner for incident response and recovery, with a reporting line to the board.
- A coverage map showing whether cyber stands alone or sits inside a combined policy.
What changes at placement
When the answers exist, the submission leads with the client’s own quantification, underwriting questions are answered from records rather than recollection, and the D&O placement can point to oversight that is documented rather than asserted. That distinction carries weight after an incident as well: as Insurance Business observed, directors who cannot show that they understand and oversee cyber risk may face scrutiny once a serious event puts their governance under examination.
When the answers do not exist, the placement starts at these questions anyway — they simply get asked by the underwriter, on the underwriter’s timeline, with pricing and terms set against the gaps. For the 19% of organizations planning to buy cyber cover within two years, the questions are the on-ramp, and the broker who asks them first is the one who shapes the submission.
“Cyber risk is now a core business risk, demanding greater board oversight and accountability,” said Glyn Thoms, global FINEX cyber strategy leader at Willis. Seven in ten boards have now written that into their risk frameworks. The broker’s edge is making sure the client is in the smaller group that can prove it — with numbers an underwriter can price and paper a director can stand behind.